A critical SQL injection vulnerability in the Simple Scheduling System 1.0 application allows unauthenticated attackers to execute arbitrary database queries remotely.

The application is susceptible to SQL injection via the corcode parameter in the /schedulingsystem/addcourse.php endpoint. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands into the database backend.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive scheduling data, potential data modification, or complete database compromise. With a CVSS score of 7.3, this high severity flaw poses a significant risk to the confidentiality and integrity of the system, potentially resulting in operational disruption and unauthorized administrative access.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected script or disable the Simple Scheduling System until a secure update is released by the vendor.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting addcourse.php, particularly those containing SQL syntax characters like quotes, semicolons, or comments.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to block SQL injection patterns to mitigate the risk of exploitation while the vulnerability remains unpatched.

Public Exploit Available: Yes, a public proof of concept is available via the GitHub issue referenced in the CVE record.

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack vector, this vulnerability presents a clear and present danger to affected environments. Organizations currently running Simple Scheduling System 1.0 must prioritize isolating the affected component or applying strict perimeter controls to prevent unauthorized access until a vendor-supplied patch is made available.