An unauthenticated SQL injection vulnerability in the code-projects Online Appointment Booking System 1.0 poses a significant risk of unauthorized database manipulation.

The application is susceptible to SQL injection via the cid parameter in the /admin/addclinic.php file, which can be exploited by an unauthenticated remote attacker to execute arbitrary SQL commands.

Successful exploitation of this vulnerability allows unauthorized actors to interface directly with the backend database, potentially leading to data exfiltration, modification, or deletion. With a CVSS score of 7.3, this flaw represents a high-severity risk that could compromise the integrity and confidentiality of the entire booking system, potentially causing significant operational disruption and loss of sensitive user information.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/addclinic.php endpoint using firewall rules or VPN requirements.

Proactive Monitoring: Security teams should monitor database logs for anomalous queries or syntax errors that indicate injection attempts and audit web server access logs for requests targeting the identified file.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the cid parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

The presence of a public proof-of-concept coupled with the lack of an official patch necessitates immediate defensive action to isolate the vulnerable component. Organizations utilizing this software must prioritize restricting access to the affected administrative interface until the vendor provides a secure update or a permanent fix can be developed internally.