An SQL injection flaw exists in the Admin/mlogin.php file of the online appointment booking system. The vulnerability arises from an unsanitized use of mysqli_query when handling the username and password fields. By manipulating these inputs, an attacker can inject arbitrary SQL that is executed directly against the database. This can lead to data extraction, modification, or even complete compromise of the system’s data layer. The defect follows the CWE identifiers 74 for improperly sanitized URL encoding and 89 for SQL injection.

All deployments of girishsaraf’s Online-Appointment-Booking-System up to the commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 are affected. The project employs a rolling release model, and a fixed version has not yet been released, meaning vulnerable unless manually patched or disabled.

The CVSS score of 6.9 indicates moderate severity. Because the EPSS score is not available, the precise likelihood of exploitation is uncertain, yet the vulnerability’s public availability and remote trigger suggest a meaningful attack probability. The vulnerability is not listed in the CISA KEV catalog, but the exposed login endpoint that accepts user input over the network makes it an attractive target for attackers familiar with this type of flaw. Overall, the risk can be considered medium to high for systems that expose the admin login to the Internet without additional safeguards.