A vulnerable AJAX endpoint named getclinic.php in the girishsaraf Online-Appointment-Booking‑System allows remote attackers to inject arbitrary SQL through manipulation of the city/cid parameter. The flaw arises from insufficient input validation and the use of unparameterized queries, satisfying both CWE‑74 and CWE‑89. Successful exploitation can let an attacker view, modify, or delete sensitive data stored in the database, compromising confidentiality, integrity, and availability of appointment information.

The affected product is girishsaraf’s Online‑Appointment‑Booking‑System. No specific version numbers are listed, and the project employs a rolling release, so affected revisions are not tracked.

The CVSS score of 6.9 indicates moderate severity, but the vulnerability is publicly exploitable from a remote location and the EPSS score is unavailable, suggesting that it may be underused or recently discovered. The vulnerability is not yet listed in CISA’s KEV catalog. Because the project has not released a fix and no official workaround has been provided, the risk remains high for deployments that have not been patched or hardened.