A critical SQL injection vulnerability in Beauty Parlour Management System v1.1 allows unauthenticated attackers to exfiltrate sensitive database information.

The application fails to properly sanitize user-supplied input in the aptnumber parameter within the /appointment-detail.php endpoint. This allows an unauthenticated attacker to inject malicious SQL statements, enabling unauthorized access to the backend database.

With a CVSS score of 9.8, this vulnerability poses a severe risk of data breach. An attacker can extract, modify, or delete sensitive customer or administrative data, leading to severe reputational damage and potential regulatory non-compliance.

Immediate Action: Restrict access to the /appointment-detail.php endpoint until a patch is applied or the application can be updated.

Proactive Monitoring: Review database query logs for evidence of SQL injection patterns, such as UNION SELECT statements or unusual syntax characters in the aptnumber field.

Compensating Controls: Implement input validation at the application level and utilize a WAF to filter out suspicious SQL queries targeting the appointment-detail.php script.

Public Exploit Available: Unknown

SQL injection remains a primary vector for data breaches. Organizations using this software must treat this as a high-priority incident, ensuring that the application is updated or that robust input validation is enforced to prevent unauthorized database access.