An unauthenticated SQL injection vulnerability in the itsourcecode E-Logbook with Health Monitoring System allows remote attackers to execute arbitrary database queries and compromise data integrity.

This is a SQL injection vulnerability (CWE-89) located in the /check_profile_old.php file. An unauthenticated attacker can inject malicious SQL commands via the profile_id POST parameter due to insufficient input sanitization.

Successful exploitation allows an attacker to bypass security controls, extract sensitive data from the underlying database, or modify records. Given the CVSS score of 7.3, this flaw poses a significant risk to the confidentiality and integrity of the system, potentially leading to unauthorized data access or total service disruption.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /check_profile_old.php endpoint and implement strict input validation for all user-supplied data.

Proactive Monitoring: Review web server and database logs for anomalous POST requests to /check_profile_old.php, specifically searching for SQL syntax characters or time-based blind injection patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the profile_id parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the GitHub issue referenced by the researcher.

Due to the lack of a vendor-provided patch, users of this software are at elevated risk. It is strongly recommended to isolate the application, apply WAF filtering, and sanitize the vulnerable source code by implementing prepared statements and parameter binding as a temporary measure until an official update is released.