An unauthenticated SQL injection vulnerability in the code-projects Online Appointment Booking System poses a significant risk of unauthorized database interaction and potential data exposure.

This vulnerability is a SQL injection flaw located in the /admin/deletedoctor.php file, which fails to properly sanitize the did argument. The attack vector is network-based and can be executed by an unauthenticated attacker.

Successful exploitation of this SQL injection vulnerability allows an attacker to manipulate backend database queries, potentially leading to unauthorized data access, modification, or deletion. Given the CVSS score of 7.3, this represents a high-severity risk that could compromise the integrity and confidentiality of appointment and user records stored within the system.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the /admin/deletedoctor.php endpoint to trusted IP addresses only or disable the affected functionality.

Proactive Monitoring: Monitor server access logs for suspicious HTTP requests targeting the /admin/deletedoctor.php file, particularly those containing SQL syntax characters such as single quotes, semicolons, or comment sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns to provide a virtual patch until a formal update is released.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability should be prioritized for immediate mitigation. Organizations utilizing the code-projects Online Appointment Booking System must implement strict access controls or WAF filtering to prevent unauthorized database access while awaiting a permanent software update from the vendor.