Description
A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-08-07
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An SQL injection flaw in the delete_appointment action of SourceCodester Simple Doctors Appointment System 1.0 allows remote attackers to manipulate the ID parameter in /admin/ajax.php. The issue can lead to extraction of sensitive appointment data, alteration of records, or potentially broader database compromise, undermining confidentiality and integrity. The vulnerability is classified under CWE‑74 and CWE‑89.

Affected Systems

The affected product is SourceCodester Simple Doctors Appointment System version 1.0, accessed via the admin/ajax.php endpoint. No additional version details are available beyond the primary release.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity risk. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting that while public exploits exist, the probability of widespread exploitation remains uncertain. Attackers can launch the exploit remotely against systems hosting the aforementioned application, provided they can reach the administrative interface.

Generated by OpenCVE AI on August 7, 2026 at 21:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check SourceCodester’s website or contact the vendor for an updated release that contains a fix for the SQL injection in delete_appointment and upgrade the application.
  • If no immediate patch is available, enforce strict input validation on the ID parameter—accept only numeric values and use parameterized queries to eliminate injection risk.
  • Restrict access to the admin/ajax.php endpoint by limiting it to trusted IP ranges or placing it behind a VPN or firewall to reduce the attack surface.

Generated by OpenCVE AI on August 7, 2026 at 21:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 07 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Title SourceCodester Simple Doctors Appointment System ajax.php delete_appointment sql injection
First Time appeared Sourcecodester
Sourcecodester simple Doctors Appointment System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:simple_doctors_appointment_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester simple Doctors Appointment System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Simple Doctors Appointment System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-07T18:30:09.760Z

Reserved: 2026-08-07T10:45:25.556Z

Link: CVE-2026-19231

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T21:15:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')