The code-projects Online Medicine Guide 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise database integrity.

This is a SQL injection vulnerability (CWE-89) affecting the /changepass.php script. An unauthenticated attacker can manipulate the ups parameter to inject malicious SQL commands, which are then processed by the underlying database without proper sanitization.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive medical or user data stored within the database. Given the CVSS score of 7.3, this flaw poses a significant risk to data confidentiality and integrity, potentially resulting in regulatory non-compliance or loss of patient trust.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /changepass.php endpoint or take the application offline until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected input in the ups parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting input parameters.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the research write-up at the provided GitHub repository reference.

This vulnerability represents a significant security risk due to the presence of a public proof-of-concept and the ease of exploitation. Organizations utilizing this software must prioritize implementing compensating controls, such as WAF filtering, and actively seek guidance from the vendor regarding a permanent security fix.