A critical SQL injection vulnerability in the code-projects Simple Scheduling System 1.0 exposes the application to remote data manipulation by unauthenticated attackers.

The application fails to properly sanitize user input within the /addtime.php script, specifically targeting the starttime and endtime arguments. This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands against the backend database.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive scheduling data, potential modification of application records, or database enumeration. With a CVSS score of 7.3, this represents a significant security risk, as the lack of authentication requirements makes the system highly susceptible to automated exploitation attempts.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /addtime.php endpoint or disable the affected scheduling functionality until a secure update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual parameters directed toward the /addtime.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, which can provide temporary protection while the vulnerability remains unpatched.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up provided via the GitHub reference.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability poses a credible threat to the integrity of the Simple Scheduling System. Organizations currently running version 1.0 are urged to implement network-level access controls or WAF protections immediately to mitigate the risk of unauthorized database interaction until the vendor provides a formal security patch.