A critical SQL injection vulnerability in code-projects Simple Scheduling System 1.0 allows for unauthenticated remote exploitation, posing a significant risk of unauthorized database access.

This vulnerability is a SQL injection (CWE-89) flaw located in the add.home.php file. An unauthenticated remote attacker can inject malicious SQL commands via the faculty argument to potentially access or manipulate backend data.

Successful exploitation of this vulnerability can lead to unauthorized data exposure, potential modification of scheduling information, and loss of data integrity. With a CVSS score of 7.3, this flaw is considered High severity due to the ease of remote, unauthenticated access to the underlying database, which may contain sensitive administrative or user information.

Immediate Action: Since no official patch is available, administrators should restrict access to the application via network controls or, if possible, disable the vulnerable component until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns, specifically targeting the add.home.php endpoint and the faculty parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rulesets designed to detect and block common SQL injection payloads in incoming HTTP requests.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the research write-up at https://github.com/yihaofuweng/cve/issues/42.

Given the public availability of a proof-of-concept and the ease of remote, unauthenticated exploitation, this vulnerability presents a credible threat to the security of the Simple Scheduling System. Organizations currently running version 1.0 should treat this as a priority, implementing WAF protections immediately and monitoring for signs of unauthorized database interaction until a definitive software patch is released by the vendor.