The Online Medicine Guide 1.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries via the uname parameter.

This is a SQL injection vulnerability (CWE-89) located in the cussignup.php file. An unauthenticated attacker can supply malicious input to the uname argument to interfere with backend database operations.

The vulnerability carries a CVSS score of 7.3, representing a high risk to the confidentiality and integrity of the application database. Successful exploitation could lead to unauthorized data extraction or modification, potentially compromising user credentials and sensitive medical information stored within the system.

Immediate Action: Since no official patch is currently available, administrators should restrict public access to the vulnerable cussignup.php endpoint or disable the registration functionality entirely if possible.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests containing SQL syntax patterns directed toward the cussignup.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block inputs containing SQL injection signatures targeting the uname parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the provided GitHub issue reference.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability poses a significant risk to organizations running the Online Medicine Guide. Organizations must prioritize restricting access to the affected script and monitor for signs of unauthorized database interaction until a formal fix is released by the vendor.