An unauthenticated SQL injection vulnerability in SourceCodester Simple Doctors Appointment System 1.0 poses a significant risk of unauthorized database access and potential system compromise.

This vulnerability is a SQL injection flaw (CWE-89) located in the /admin/ajax.php file, triggered by manipulating the email argument during the authentication process. The flaw allows an unauthenticated, remote attacker to execute arbitrary SQL commands against the backend database.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive healthcare data, including doctor and patient information stored within the application database. Given the CVSS score of 7.3, this represents a high-severity risk that could result in significant data breaches, loss of customer trust, and potential regulatory non-compliance.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for suspicious activity targeting the /admin/ajax.php endpoint, specifically looking for SQL syntax patterns in the email parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads in HTTP requests.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up at the referenced GitHub repository.

Due to the availability of a public proof-of-concept and the ease of exploitation, this vulnerability should be prioritized for mitigation. Organizations currently running this software must implement strict access controls immediately to prevent potential unauthorized access to their database while awaiting a formal vendor security update.