A critical SQL injection vulnerability in code-projects Simple Scheduling System 1.0 permits unauthenticated remote attackers to compromise backend database integrity.

The application is susceptible to SQL injection (CWE-89) within the addsubject.php file, specifically through the subcode argument. This flaw allows an unauthenticated remote attacker to manipulate database queries without requiring prior system access.

The ability for an unauthenticated attacker to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized data exfiltration, modification of application records, or potential denial of service. With a CVSS score of 7.3, this high-severity vulnerability necessitates immediate attention to prevent unauthorized administrative or user account manipulation.

Immediate Action: As no official patch is currently available, administrators should restrict access to the addsubject.php endpoint or disable the affected functionality until a vendor-supplied security update is released.

Proactive Monitoring: Review web server and database logs for suspicious HTTP requests containing SQL syntax, such as UNION, SELECT, or OR statements, directed at the addsubject.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified vulnerable parameter.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced in the GitHub issue tracker.

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently running Simple Scheduling System 1.0 should prioritize implementing the suggested compensating controls and monitor for vendor updates, as the lack of a formal patch leaves the system exposed to automated exploitation attempts.