The Online Medicine Guide 1.0 application is vulnerable to remote SQL injection, which could allow an unauthenticated attacker to compromise backend database integrity.

This is a SQL injection vulnerability (CWE-89) located in the /cusfindambulence2.php file. The application fails to properly sanitize the Search parameter, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Successful exploitation of this vulnerability can lead to unauthorized access to database contents, potential data exfiltration, or the corruption of application records. With a CVSS score of 7.3, this flaw represents a significant risk to confidentiality and integrity. Given that the attack requires no authentication, the barrier to entry for malicious actors is extremely low, potentially leading to total loss of control over the application data.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /cusfindambulence2.php endpoint or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous characters in URI parameters, specifically looking for SQL syntax patterns targeting the Search argument.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads and input anomalies directed at the vulnerable file.

Public Exploit Available: Yes, a public proof-of-concept exists, attributed to the research submission documented at https://github.com/joker-vip/cvesubmit/issues/1.

Due to the availability of a public proof-of-concept and the unauthenticated nature of this vulnerability, immediate mitigation is required. Organizations using code-projects Online Medicine Guide 1.0 should prioritize blocking access to the vulnerable script or implementing strict input validation via a WAF to prevent potential exploitation while awaiting a permanent vendor fix.