A critical SQL injection vulnerability in code-projects Online Medicine Guide 1.0 exposes the system to remote, unauthenticated data manipulation.

This is a SQL injection vulnerability (CWE-89) affecting the uname parameter within the /cart/index.php file. The vulnerability is exploitable remotely by an unauthenticated attacker, allowing for unauthorized interaction with the underlying database.

Successful exploitation of this flaw allows an attacker to execute arbitrary SQL commands, which may lead to unauthorized data access, modification of database contents, or potential service disruption. With a CVSS score of 7.3, this vulnerability represents a high risk to data integrity and confidentiality for organizations utilizing this software.

Immediate Action: As no official vendor patch is currently available, administrators should restrict public access to the /cart/index.php endpoint or disable the affected module entirely until a fix is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns, particularly targeting the uname parameter in the /cart/index.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads to mitigate the risk of exploitation.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Administrators must treat this as a priority and implement stringent access controls or WAF protections immediately. Until the vendor provides a secure update, the software should be considered compromised if exposed to the public internet.