A critical SQL injection vulnerability exists in code-projects Online Medicine Guide 1.0 that enables remote attackers to execute unauthorized database queries without authentication.

The application is susceptible to SQL injection via the phuname parameter within the pharsignup.php script. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands into the database backend.

Successful exploitation of this vulnerability can lead to unauthorized access, modification, or deletion of sensitive medical and user data stored within the application database. Given the CVSS score of 7.3, this represents a high risk to data confidentiality and integrity. The ability for unauthenticated remote actors to trigger this flaw significantly increases the potential for widespread data exfiltration.

Immediate Action: Since an official patch is currently unknown, administrators should restrict access to the affected script or disable the registration module until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for suspicious patterns involving pharsignup.php, specifically monitoring for SQL syntax characters such as single quotes, semicolons, or comments in the phuname parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules configured to detect and block SQL injection payloads targeting the pharsignup.php endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to organizational data security. Organizations should prioritize isolating the affected application from public-facing networks until a vendor-provided patch is available and verified. Failure to mitigate this flaw could result in full exposure of the application database.