An unauthenticated SQL injection vulnerability in Beauty Parlour Management System v1.1 enables attackers to compromise sensitive database content.

This is a classic SQL injection vulnerability located in the /appointment-detail.php endpoint. The attacker does not require authentication (PR:N) to supply malicious SQL statements via the aptnumber parameter.

The vulnerability allows for unauthorized access to the application's database, which likely contains sensitive customer or appointment information. A CVSS score of 9.8 reflects the high risk of data exfiltration and potential loss of confidentiality and integrity, which could lead to significant reputational damage and regulatory non-compliance.

Immediate Action: Since no official patch is currently available, disable the affected endpoint or the application entirely until a security update is released by the vendor.

Proactive Monitoring: Review database query logs for suspicious patterns, such as unexpected SQL keywords (e.g., UNION, SELECT, SLEEP) targeting the aptnumber parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious traffic directed at the /appointment-detail.php page.

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub.

Due to the lack of an official vendor patch and the presence of a public proof-of-concept, this application should be considered insecure. Administrators must implement aggressive WAF filtering or isolate the system from the network until a formal remediation is provided by the developers.