A critical SQL injection vulnerability in SourceCodester Medical Center Portal Management System 1.0 allows for unauthenticated remote exploitation, posing a significant risk of data compromise.

The application is susceptible to SQL injection (CWE-89) due to improper sanitization of the ID parameter within the /emp_edit1.php file. The vulnerability is exploitable by unauthenticated remote attackers.

Successful exploitation allows an attacker to inject arbitrary SQL commands into the backend database, which may result in unauthorized data access, modification, or deletion. With a CVSS score of 7.3, this high-severity flaw threatens the confidentiality and integrity of sensitive patient or administrative information stored within the portal.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the vulnerable /emp_edit1.php file or take the system offline until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax, such as UNION, SELECT, or OR 1=1, targeted at the /emp_edit1.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch until the vendor provides a formal update.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Given the availability of a public proof-of-concept and the lack of an official vendor patch, this vulnerability presents an immediate risk to any environment hosting the Medical Center Portal Management System. Security teams must prioritize identifying instances of this software and implementing the recommended compensating controls immediately to prevent unauthorized database access.