A remote SQL injection vulnerability in code-projects Online Medicine Guide 1.0 allows unauthenticated attackers to compromise database integrity.

This is a SQL injection vulnerability (CWE-89) located in the login.php file, specifically within the uname argument. The vulnerability allows an unauthenticated remote attacker to inject malicious SQL queries into the application.

The exploitation of this vulnerability can lead to unauthorized access to the underlying database, potentially resulting in the exposure of sensitive medical or user information. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and application integrity, which could lead to severe reputational damage and regulatory non-compliance.

Immediate Action: As there is no official patch available, administrators should restrict access to the login page via network-level controls or web application firewalls until a fix is released.

Proactive Monitoring: Monitor database query logs for suspicious patterns or unexpected syntax that may indicate SQL injection attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block malicious SQL injection payloads targeting the uname parameter.

Public Exploit Available: Yes, a public proof-of-concept exists via the researcher's GitHub issue report.

The presence of a public proof-of-concept elevates the risk of this vulnerability significantly. Organizations currently running code-projects Online Medicine Guide 1.0 must treat this as a high-priority item, applying restrictive network access controls immediately to prevent unauthorized exploitation while awaiting a vendor-provided security update.