A critical SQL injection vulnerability in code-projects Simple Scheduling System 1.0 allows remote, unauthenticated attackers to compromise database integrity and potentially access sensitive information.

The application is susceptible to CWE-89 (SQL Injection) within the addroom.php file, where the room parameter fails to properly sanitize user-supplied input. This flaw is exploitable by an unauthenticated remote attacker.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized data access, modification, or deletion within the underlying database. Given the CVSS score of 7.3, this represents a high risk to data confidentiality and integrity, potentially leading to a complete breach of application data or service disruption.

Immediate Action: Since a vendor-supplied patch is currently unknown, administrators should restrict network access to the /schedulingsystem/addroom.php endpoint or disable the affected scheduling functionality entirely.

Proactive Monitoring: Security teams should monitor web access logs for unusual patterns or characters indicative of SQL injection attempts, such as single quotes, double dashes, or SQL keywords in the room parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application parameters.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Given the availability of a public proof-of-concept and the lack of a verified vendor patch, this vulnerability poses a significant risk to affected installations. Organizations using Simple Scheduling System 1.0 must prioritize isolating the application or implementing robust WAF filtering to prevent exploitation until a security update is released by the vendor.