A vulnerability exists in the book.php component of girishsaraf Online-Appointment-Booking-System that allows a remote attacker to inject SQL by manipulating the Doctor/appointment parameter. The injection can modify or disclose database contents, potentially exposing sensitive scheduling data.

The affected product is the Online-Appointment-Booking-System bundled by girishsaraf. No specific version numbers are available because the project uses a rolling release strategy; therefore all current installations are potentially affected.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but a public exploit is available and the attack vector is remote. Attackers can exploit this weakness over the network to read or alter appointment data and, depending on database permissions, gain broader access to the underlying database.