The SourceCodester COVID 19 Testing Management System is vulnerable to a remote SQL injection attack that allows unauthenticated adversaries to interact with the backend database.

This vulnerability is a SQL injection flaw (CWE-89) located within the /check_availability.php script. An unauthenticated attacker can manipulate the employeeid argument to execute arbitrary SQL commands against the database.

The ability for an unauthenticated user to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive testing data, potential administrative account compromise, or database disruption. With a CVSS score of 7.3, this high severity vulnerability requires immediate attention to prevent unauthorized data exfiltration.

Immediate Action: As no vendor patch is currently available, administrators should restrict access to the affected /check_availability.php file via network-level controls or disable the component if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual characters directed at the /check_availability.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to block malicious payloads targeting the employeeid parameter.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the research write-up referenced at GitHub.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a tangible risk to the environment. Organizations currently running this software should prioritize isolating the affected system from public-facing networks until a vendor-supplied security patch is released and verified.