A flaw in the Patient Login Handler of the Online‑Appointment‑Booking‑System allows an attacker to manipulate the uname and psw inputs, causing the application to build an untrusted SQL query through the mysqli_query function. This vulnerability can be exploited remotely to inject arbitrary SQL statements into the database. Successful exploitation may grant an attacker unauthorized read, modification, or deletion of data stored in the system, leading to confidentiality and integrity violations.

The vulnerable version of the Online‑Appointment‑Booking‑System is created by the developer girishsaraf. The precise revision is not publicly pinned, but any instance running a release prior to the commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 may be affected. No specific version numbers are reported.

The CVSS score of 6.9 indicates medium‑to‑high severity. EPSS data is not available, but the vulnerability has a publicly released exploit, and the attack can be launched from any remote host that can access the web interface. The attack vector is inferred to be a web request providing crafted uname or psw parameters. Since it is not listed in the CISA KEV catalog, it has not yet been observed as part of a widespread attack campaign.