A critical SQL injection vulnerability in the code-projects Online Appointment Booking System allows unauthenticated remote attackers to manipulate database queries.

This vulnerability is a SQL injection flaw (CWE-89) triggered by improper sanitization of the city argument within the /admin/getmanagerregion.php file. The vulnerability is remotely exploitable without requiring authentication.

Successful exploitation of this SQL injection vulnerability could allow an attacker to gain unauthorized access to sensitive information stored within the application database. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to data exfiltration or potential compromise of the underlying application logic, resulting in significant operational and reputational damage.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/getmanagerregion.php endpoint or disable the affected functionality until a vendor fix is released.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting /admin/getmanagerregion.php, particularly those containing SQL syntax characters like single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection attempts against the application.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the linked GitHub repository.

The severity of this vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate defensive action. Organizations utilizing the Online Appointment Booking System must prioritize limiting exposure of the vulnerable administrative endpoint to untrusted networks and prepare for an emergency update once the vendor provides a formal security patch.