An unauthenticated SQL injection vulnerability in Campcodes Complete Online Beauty Parlor Management System 1.0 allows remote attackers to execute arbitrary database queries.

This vulnerability is a SQL injection flaw (CWE-89) located in the admin/view-appointment.php file, which fails to properly sanitize the viewid argument. The vulnerability can be exploited by an unauthenticated remote attacker.

Successful exploitation of this SQL injection vulnerability could allow an attacker to bypass authentication, access sensitive data stored within the database, or potentially modify administrative records. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the application, which could lead to unauthorized access to customer appointments and personal information.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the /admin/ directory using IP allowlisting or VPN requirements.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting /admin/view-appointment.php, particularly those containing SQL syntax characters like single quotes or comment sequences.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the viewid parameter.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up found at the GitHub repository linked in the official CVE references.

The presence of a public proof-of-concept combined with the unauthenticated nature of this vulnerability necessitates immediate defensive action. Organizations using this software must restrict access to the affected management interface until an official vendor patch is released and verified. Prioritize the implementation of network-level access controls to mitigate the risk of remote exploitation.