SQL Injection in SourceCodester Simple Doctors Appointment System

A remote SQL injection vulnerability has been identified in SourceCodester Simple Doctors Appointment System version 1.0. The vulnerability resides within the '/admin/ajax.php' script when the 'action' parameter is set to 'delete_appointment'. By manipulating the 'ID' argument, an unauthenticated remote attacker can inject malicious SQL commands into the application database. This flaw exists due to improper neutralization of special elements in the user-supplied input used within SQL queries. Publicly available exploit code exists for this vulnerability, significantly increasing the risk of exploitation for organizations deploying this system. Defenders should prioritize restricting access to the administrative endpoint or implementing input validation for the 'ID' parameter.

Attack Chain

1. Attacker performs reconnaissance to identify instances of Simple Doctors Appointment System.
2. Attacker crafts an HTTP GET or POST request targeting '/admin/ajax.php'.
3. Attacker sets the 'action' parameter to 'delete_appointment'.
4. Attacker injects SQL payloads into the 'ID' parameter to bypass authentication or extract data.
5. The application fails to sanitize the input and passes the malicious string directly to the database engine.
6. The database executes the injected commands, resulting in unauthorized data access, modification, or potential system compromise.

Impact

Successful exploitation allows for unauthorized interaction with the underlying database. Depending on the database permissions, this could result in data exfiltration, deletion of patient appointment records, or further compromise of the web server.

Recommendation

1. Restrict access to the '/admin/ajax.php' administrative endpoint to authorized IP addresses only.
2. Review web server access logs for requests containing suspicious characters (e.g., single quotes, semicolons, comments) within the 'ID' parameter of the identified script.
3. Apply input validation and parameterized queries to the affected '/admin/ajax.php' file to neutralize the SQL injection vulnerability.