Description
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data Breach via SQL Injection
Action: Apply Patch
AI Analysis

Impact

A flaw in the Online-Appointment-Booking-System allows attackers to inject arbitrary SQL through the fname parameter in the signup.php Registration Handler. The injected SQL can be used to read, modify or delete database contents, potentially exposing sensitive user data or compromising the integrity of the system. The vulnerability is not a direct remote code execution flaw, but the manipulation of the database layer can lead to unauthorized data disclosure or modification, qualifying as a moderate to high data breach risk.

Affected Systems

The affected product is the girishsaraf Online-Appointment-Booking-System. All releases up to the commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 contain the vulnerable function; versions beyond this commit are not guaranteed to be safe due to the project's rolling release model, so any currently deployed instance is potentially affected.

Risk and Exploitability

The CVSS score of 6.9 indicates that the vulnerability can have a serious impact. EPSS is not available to quantify exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw remotely without any special local access, as the vulnerable input is reachable from the public signup page. The publicly released exploit demonstrates that remote attackers can inject SQL successfully, making the risk realistic for exposed deployments.

Generated by OpenCVE AI on October 6, 2026 at 00:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the application to a commit after f427b4757128ca253d33d0cc4e87bbb9c999a4d5 or to a maintained fork that addresses the SQL injection.
  • In signup.php, sanitize all user input and replace vulnerable string concatenation with parameterized queries or prepared statements to eliminate direct SQL injection.
  • Deploy a web application firewall rule that inspects and blocks suspicious SQL payloads in the fname parameter to provide additional runtime protection.

Generated by OpenCVE AI on October 6, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 05 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Title girishsaraf Online-Appointment-Booking-System Registration signup.php sql injection
First Time appeared Girishsaraf
Girishsaraf online-appointment-booking-system
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*
Vendors & Products Girishsaraf
Girishsaraf online-appointment-booking-system
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Girishsaraf Online-appointment-booking-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-06T13:11:53.190Z

Reserved: 2026-10-05T14:58:23.462Z

Link: CVE-2026-105471

cve-icon Vulnrichment

Updated: 2026-10-06T13:11:49.580Z

cve-icon NVD

Status : Deferred

Published: 2026-10-06T00:16:32.920

Modified: 2026-10-06T15:04:52.637

Link: CVE-2026-105471

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T00:30:18Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')