A critical SQL injection vulnerability in the code-projects Online Appointment Booking System allows unauthenticated remote attackers to compromise the backend database.

This vulnerability is a SQL injection flaw (CWE-89) located in the /admin/deletedoctorclinic.php file. An unauthenticated attacker can manipulate the clinic parameter to execute arbitrary SQL commands against the database.

Successful exploitation allows an attacker to manipulate the underlying database, potentially leading to unauthorized data access, modification, or deletion. With a CVSS score of 7.3, this represents a high-severity risk that could compromise the integrity and confidentiality of sensitive scheduling and user information stored within the system.

Immediate Action: Since no official patch is currently available, restrict access to the /admin/ directory using IP allowlisting or VPN requirements to prevent unauthenticated access.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the /admin/deletedoctorclinic.php endpoint, specifically looking for SQL syntax patterns or unusual character encoding in the clinic parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the identified file and parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the CVE record.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, immediate mitigation is required to prevent potential compromise. Organizations should prioritize isolating the affected application from public networks until a security update is released or custom remediation is implemented to sanitize the vulnerable input parameter.