The code-projects Online Appointment Booking System version 1.0 is vulnerable to remote SQL injection, posing a significant risk of unauthorized database access or manipulation.

This is a SQL injection vulnerability (CWE-89) located in the /admin/adddoctorclinic.php file. The vulnerability occurs because the application fails to properly sanitize the clinic argument, allowing an unauthenticated remote attacker to execute arbitrary SQL commands.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive data stored within the appointment booking database, including personal information or administrative credentials. Given the CVSS score of 7.3, this flaw represents a significant risk to the confidentiality and integrity of the system, potentially facilitating further unauthorized access or service disruption.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin directory using network-level controls or authentication proxies until the vendor provides a security update.

Proactive Monitoring: Monitor server logs for suspicious database queries, specifically those containing SQL syntax characters (e.g., single quotes, semicolons, or comment indicators) directed at the /admin/adddoctorclinic.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to mitigate the risk of exploitation while the vulnerability remains unpatched.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability report.

This vulnerability presents a high risk due to the ease of remote exploitation and the existence of a public proof-of-concept. Organizations should prioritize restricting access to the affected administrative endpoint immediately and monitor for any signs of anomalous activity until an official vendor patch is released and applied.