A critical SQL injection vulnerability in code-projects Online Medicine Guide 1.0 allows for unauthenticated remote exploitation, posing a significant risk of database compromise.

This vulnerability is a SQL injection flaw (CWE-89) triggered by improper sanitization of the mname argument within the adaddmed.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, allowing them to manipulate backend database interactions.

Successful exploitation of this flaw could allow unauthorized actors to read, modify, or delete sensitive data stored within the application database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to unauthorized access to patient or medical information managed by the platform.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the application or disable the vulnerable adaddmed.php component until a secure update is provided.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected input in the mname parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting input parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

The presence of a public proof-of-concept combined with the unauthenticated nature of this vulnerability necessitates immediate defensive action. Organizations using code-projects Online Medicine Guide 1.0 must prioritize isolating the affected component and deploying compensating controls to mitigate the risk of unauthorized database access while awaiting a vendor-supplied security update.