Description
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqli_query of the file locateus.php of the component Doctor Search Endpoint. The manipulation of the argument doctorname leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection – Data Exposure
Action: Patch Now
AI Analysis

Impact

A SQL injection flaw exists in the Doctor Search Endpoint locateus.php of the Online-Appointment-Booking-System. The flaw allows an attacker to manipulate the doctorname parameter in the call to mysqli_query, enabling the execution of arbitrary SQL statements. If successful, this could lead to unauthorized data disclosure, modification, or deletion within the underlying database.

Affected Systems

All instances of the Online-Appointment-Booking-System released up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 are vulnerable. Because the project uses a rolling release model, specific patched versions are not listed, but any version that has not incorporated a fix is affected.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is available, but a publicly available exploit has been demonstrated, meaning remote exploitation is feasible. The vulnerability is not yet listed in the CISA KEV catalog. Attackers can trigger the flaw via a crafted HTTP request to the locateus.php endpoint, exploiting the lack of input sanitization.

Generated by OpenCVE AI on October 5, 2026 at 23:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the project’s GitHub repository for a newer commit that addresses the issue and upgrade the application accordingly.
  • Refactor the database interaction to use prepared statements or bound parameters, ensuring that user-supplied input cannot alter the intended SQL query structure.
  • Deploy a web application firewall rule that inspects and blocks suspicious SQL injection patterns directed at the Doctor Search Endpoint.
  • Configure database logging and monitor for anomalous query activity to detect potential exploitation attempts.

Generated by OpenCVE AI on October 5, 2026 at 23:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqli_query of the file locateus.php of the component Doctor Search Endpoint. The manipulation of the argument doctorname leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Title girishsaraf Online-Appointment-Booking-System Doctor Search Endpoint locateus.php mysqli_query sql injection
First Time appeared Girishsaraf
Girishsaraf online-appointment-booking-system
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*
Vendors & Products Girishsaraf
Girishsaraf online-appointment-booking-system
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Girishsaraf Online-appointment-booking-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-06T17:40:59.768Z

Reserved: 2026-10-05T14:58:20.097Z

Link: CVE-2026-105470

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-05T23:17:01.520

Modified: 2026-10-06T18:16:45.500

Link: CVE-2026-105470

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T00:00:16Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')