The vulnerability resides in the /appointment-detail.php endpoint of Beauty Parlour Management System v1.1. An attacker can supply a crafted value for the aptnumber parameter, causing the application to build an untrusted SQL query. This allows execution of arbitrary SQL statements, enabling attackers to read, modify, or delete any data stored in the database. The primary consequence is a potential loss of confidentiality, integrity, and availability of the system’s information.

Vulnerable system is Beauty Parlour Management System version 1.1. No additional vendor or patch information is available, and the product name is provided directly from the storage platform. The database behind the application serves sensitive customer and appointment data.

The CVSS score is 9.8, and EPSS data is unavailable, but the exploit is clearly possible via a standard HTTP request to the mentioned endpoint. Since the vulnerability is not listed in the CISA KEV catalog, it has not yet been confirmed as exploited in the wild. Nonetheless, the lack of protection around input handling and database query construction makes it likely that attackers can exploit it without additional privileges, making the risk moderate to high in environments where the system is exposed to the internet.