A critical SQL injection vulnerability in the code-projects Online Appointment Booking System 1.0 enables unauthenticated remote attackers to compromise database integrity.

This is a SQL injection (CWE-89) vulnerability located in the /admin/addmanagerclinic.php file. An unauthenticated attacker can inject malicious SQL commands via the clinic parameter to interact directly with the backend database.

The ability for an unauthenticated user to execute arbitrary SQL commands poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to administrative data, sensitive user information, or full application compromise. Given the CVSS score of 7.3, this represents a high-severity risk that could facilitate data exfiltration or unauthorized administrative actions.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN requirements until a vendor-provided update is released.

Proactive Monitoring: Monitor server access logs for requests containing SQL syntax patterns or unexpected character strings targeting the /admin/addmanagerclinic.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection attempts targeting the affected parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up at https://github.com/jaynewboy/cve/issues/1.

Due to the availability of a public proof-of-concept and the ease of exploitation via unauthenticated remote access, this vulnerability requires immediate attention. Organizations utilizing this software must implement strict network-level access controls or WAF filtering to prevent exploitation while awaiting a permanent vendor patch.