The vulnerability arises from improperly sanitized input in the AJAX endpoint get_town.php. Malicious actors can supply crafted values for countryid, townid, cid, didval, or cidval, causing the backend to incorporate those values directly into SQL statements. This meets the criteria for CWE‑74 (The Role of Bad Input) and CWE‑89 (SQL Injection). Since the injection occurs through an exposed HTTP endpoint, an attacker can trigger it remotely without requiring authentication.

The only vendor/product listed is girishsaraf Online-Appointment-Booking-System, a rolling‑release web application that lacks a formal versioning scheme. All deployments that have not applied a fix to the get_town.php code are affected because the vulnerability exists in all codebases prior to the unspecified commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score is not available, leaving uncertainty about current exploitation prevalence. The vulnerability is not catalogued in CISA’s KEV list, but the public disclosure and the remote nature of the attack suggest that exploitation could occur. An attacker could gain unauthorized read or write access to the database, leading to data loss, confidentiality breach, or further lateral movement within the system.