The vulnerability arises from insufficient input validation in the changebookingstatus.php script of the Online‑Appointment‑Booking‑System. An attacker manipulating the dateselected parameter can inject arbitrary SQL statements, enabling unauthorized read or modification of the database. This flaw can lead to data exposure, unauthorized changes to appointment schedules, and potentially broader system compromise if the database account has elevated privileges.

Affected products include the Online‑Appointment‑Booking‑System from girishsaraf. Version information is not specified because the project follows a rolling release model; users of the current branch or earlier commits prior to f427b4757128ca253d33d0cc4e87bbb9c999a4d5 are potentially exposed.

The CVSS score of 6.9 indicates moderate to high severity, and the EPSS score is not available. The vulnerability is not yet listed in the CISA KEV catalog, but a public exploit is available and the attack can be launched remotely. Due to the lack of a patch, the risk is elevated, especially for environments that expose the web interface externally or use a database account with broad permissions.