The vulnerability exists in the Admin/deleteclinic.php script of the Online-Appointment-Booking-System. Manipulation of the cid or did query parameters allows an attacker to inject arbitrary SQL statements. This flaw can result in unauthorized disclosure, modification, or deletion of database records that belong to the application. The CVE notes that remote exploitation is possible, indicating that an attacker can trigger the vulnerability from outside the network without needing to log in.

The affected product is the Online-Appointment-Booking-System maintained by girishsaraf. All releases up to the commit hash f427b4757128ca253d33d0cc4e87bbb9c999a4d5 contain the vulnerable code. Because the project employs a rolling release model, no discrete version numbers are available for the fix, and the vendor has not yet released an official patch.

The CVSS score of 6.9 indicates a moderate level of severity. The EPSS score is not provided, and the vulnerability is not currently listed in the CISA KEV catalog, so the overall exploitation risk remains uncertain. The attack vector is remote via HTTP requests to deleteclinic.php, and the exploit can be executed by sending crafted cid or did parameters containing SQL. The vulnerability allows both data extraction and modification of records, potentially leading to compromise of confidential patient information and integrity of the appointment data.