An unauthenticated SQL injection vulnerability in the code-projects Online Appointment Booking System 1.0 poses a critical risk of full database compromise.

This is a SQL injection flaw located in the /admin/deletemanagerclinic.php file, where the clinic parameter fails to undergo sufficient input validation. The vulnerability is exploitable by an unauthenticated attacker, as no login or authorization is required to submit the malicious payload.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands, resulting in unauthorized database access, data leakage, or data tampering. Given the CVSS score of 7.3, this flaw represents a significant risk to the confidentiality and integrity of system information, potentially leading to total loss of control over the application database.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the /admin/ directory using IP allowlisting or authentication via a front-end reverse proxy.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the /admin/deletemanagerclinic.php endpoint, specifically looking for SQL syntax patterns or database function calls.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection payloads targeting the clinic parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository issue.

Due to the lack of an official vendor patch and the availability of a public exploit, this system should be considered highly vulnerable if exposed to the internet. Administrators must prioritize isolating the affected component and implementing strict input validation or WAF rules to prevent unauthorized database interaction until a vendor-supplied update is released.