An unauthenticated SQL injection vulnerability in code-projects Online Hospital Management System 1.0 allows remote attackers to manipulate database queries via the delid parameter in viewappointment.php, posing a severe risk of data compromise and record destruction.

This vulnerability is an SQL injection flaw (CWE-89) located in the viewappointment.php file. The unauthenticated attacker can supply malicious input via the delid parameter, which is directly concatenated into a SQL query without sanitization or parameterized protection.

Successful exploitation permits malicious actors to execute arbitrary database commands, leading to unauthorized data extraction, extraction of sensitive admin credentials, and the mass deletion of appointment records. These actions can result in severe data loss, operational downtime, and a compromise of patient confidentiality. The CVSS score of 7.3 reflects the high severity of enabling unauthenticated remote data manipulation.

Immediate Action: Refactor the vulnerable viewappointment.php script to use prepared statements and parameterized queries for the delid parameter, and implement strict session-based authentication checks before processing any deletion logic.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests targeting viewappointment.php, particularly those containing SQL syntax characters such as single quotes or sleep functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block inbound HTTP requests to viewappointment.php containing suspicious SQL injection patterns in the delid parameter.

Public Exploit Available: Yes, a public exploit and detailed technical write-up are available on GitHub via the researcher references.

Security teams must treat this vulnerability with high urgency due to the availability of public proof-of-concept exploit code and the complete lack of authentication requirements. Immediate code modification to adopt prepared statements and robust access controls is required to protect the application environment.