An unauthenticated SQL injection vulnerability in SourceCodester Eye Clinic Management System 1.0 poses a significant risk of unauthorized database access and potential data exfiltration.

This is a SQL injection vulnerability (CWE-89) occurring within the /main/search_index_Diagnosis.php file. An unauthenticated attacker can manipulate the Search parameter to execute arbitrary SQL commands against the backend database.

The ability for an unauthenticated attacker to inject malicious SQL queries allows for the unauthorized retrieval, modification, or deletion of sensitive clinical data. With a CVSS score of 7.3, this high-severity flaw threatens patient privacy, regulatory compliance, and the overall integrity of the management system.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application or disable the affected module if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous GET or POST requests directed at the /main/search_index_Diagnosis.php endpoint, specifically looking for SQL syntax patterns in the Search parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules configured to detect and block SQL injection payloads targeting the Search parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up hosted on GitHub.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability should be prioritized for mitigation. Organizations currently running this system should implement strict input validation or network-level access controls immediately until an official vendor update is released.