A critical SQL injection vulnerability in code-projects Online Medicine Guide version 1.0 exposes the application to remote data manipulation by unauthenticated attackers.

The application is susceptible to SQL injection via the Search parameter in the cusfindphar2.php file, which lacks sufficient input sanitization. This vulnerability is remotely exploitable by unauthenticated attackers.

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk to the confidentiality and integrity of the application data. Successful exploitation allows an attacker to execute arbitrary SQL commands, potentially leading to unauthorized access to sensitive medical information or the total compromise of the underlying database.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected endpoint or disable the vulnerable component entirely.

Proactive Monitoring: Monitor web server logs for anomalous HTTP requests targeting cusfindphar2.php, specifically looking for SQL syntax patterns or unexpected character sequences in the Search parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter and block malicious SQL injection payloads targeting the identified parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability poses a significant risk. Organizations currently running Online Medicine Guide 1.0 must prioritize isolating the affected system from public-facing networks until a vendor-supplied patch is released and verified.