A critical SQL injection vulnerability in the code-projects Online Appointment Booking System allows remote, unauthenticated attackers to compromise database integrity.

This flaw is a SQL injection vulnerability (CWE-89) affecting the /admin/adddoctor.php file. An unauthenticated remote attacker can inject malicious SQL commands through the Username parameter, potentially leading to unauthorized database manipulation.

The ability for an unauthenticated user to execute arbitrary SQL commands poses a severe risk to data confidentiality and integrity. With a CVSS score of 7.3, this vulnerability could allow an attacker to bypass authentication, dump sensitive user data, or modify system records, leading to significant operational disruption and a loss of user trust.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin/adddoctor.php endpoint or take the application offline until a fix is provided by the vendor.

Proactive Monitoring: Review web access logs for unusual patterns or characters in the Username field, such as single quotes, dashes, or SQL keywords, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application's input parameters.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue and PoC repository.

Given the availability of public proof-of-concept code and the ease of exploitation via the web interface, this vulnerability represents a significant risk. Organizations currently running version 1.0 of the code-projects Online Appointment Booking System must implement strict network-level access controls or disable the vulnerable component immediately to prevent unauthorized database access.