An unauthenticated SQL injection vulnerability in code-projects Online Medicine Guide 1.0 allows remote attackers to compromise database integrity and access sensitive information.

The application fails to properly sanitize user input in the del parameter within the /addelidetails.php file. This flaw allows unauthenticated attackers to inject malicious SQL commands, leading to unauthorized database operations.

Successful exploitation of this vulnerability can result in full database compromise, unauthorized data exfiltration, and potential service disruption. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, as the lack of required authentication makes the application easily targetable by remote actors.

Immediate Action: As there is no official patch available, administrators should immediately restrict access to the vulnerable /addelidetails.php file or take the application offline until the source code can be manually hardened using prepared statements.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters in the del parameter. Monitor database query logs for unusual or unauthorized execution patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the application endpoints. Ensure the database service account is configured with the principle of least privilege to limit the scope of potential data exposure.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked GitHub repository issue.

Due to the availability of public exploit material and the lack of a vendor-provided patch, this vulnerability poses an immediate threat to any deployment of Online Medicine Guide 1.0. Organizations must prioritize either removing the vulnerable component or applying custom remediation by implementing parameterized queries to neutralize the SQL injection vector.