An unauthenticated SQL injection vulnerability in SourceCodester Simple Doctors Appointment System 1.0 allows remote attackers to execute arbitrary database queries, potentially leading to full system compromise.

This vulnerability is a SQL injection flaw (CWE-89) located in the /admin/login.php file. The application fails to properly sanitize the username parameter before incorporating it into database queries, allowing an unauthenticated attacker to manipulate SQL commands.

Successful exploitation of this vulnerability allows unauthorized access to the underlying database, which may result in the exfiltration of sensitive patient or administrative information. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to complete data exposure, unauthorized administrative access, and significant operational disruption.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the administrative login page and implement strict input validation on the affected parameter.

Proactive Monitoring: Monitor web server logs for suspicious POST requests to /admin/ajax.php or /admin/login.php that contain SQL keywords or unusual character patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block common SQL injection payloads targeted at the username parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced security research.

Due to the critical nature of SQL injection and the lack of a vendor-provided patch, users of the Simple Doctors Appointment System should consider the software insecure for production environments. If the system must remain online, ensure it is isolated from public networks and protected by robust WAF rules until a secure version is released.