Description
A flaw has been found in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=login2. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Published: 2026-03-31
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Apply Patch
AI Analysis

Impact

A flaw in SourceCodester Simple Doctors Appointment System allows manipulation of the 'email' argument in the /admin/ajax.php?action=login2 endpoint to inject arbitrary SQL commands. This vulnerability can enable an attacker to read, modify, or delete data in the underlying database, potentially exposing sensitive patient information or compromising the integrity of appointment records. The weakness is a classic SQL injection (CWE-74 and CWE-89).

Affected Systems

The affected product is SourceCodester Simple Doctors Appointment System version 1.0. The vulnerability resides in the /admin/ajax.php script handling the login2 action. No other versions or components are listed as affected.

Risk and Exploitability

The CVSS base score is 6.9, indicating moderate severity. No EPSS score is available and the vulnerability is not listed in CISA's KEV catalog, suggesting limited known exploitation or supply chain risk. Attackers can exploit the issue remotely by sending a crafted 'email' parameter to the login2 endpoint, possibly bypassing authentication or reading confidential data. There is no official workaround, so remediation depends on applying a vendor patch or secure coding changes.

Generated by OpenCVE AI on March 31, 2026 at 05:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest vendor patch for SourceCodester Simple Doctors Appointment System.
  • If no patch is available, modify the /admin/ajax.php script to validate and escape the email input or use prepared statements.
  • Restrict access to the /admin/ajax.php endpoint to authenticated administrators only.
  • Monitor application logs for suspicious login attempts or malformed queries.

Generated by OpenCVE AI on March 31, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 03 Apr 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester doctor Appointment System
Vendors & Products Sourcecodester
Sourcecodester doctor Appointment System

Tue, 31 Mar 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 31 Mar 2026 04:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=login2. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Title SourceCodester Simple Doctors Appointment System ajax.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Doctor Appointment System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-31T18:04:54.073Z

Reserved: 2026-03-30T18:58:59.825Z

Link: CVE-2026-5180

cve-icon Vulnrichment

Updated: 2026-03-31T15:05:14.508Z

cve-icon NVD

Status : Deferred

Published: 2026-03-31T05:16:12.143

Modified: 2026-04-24T18:11:16.583

Link: CVE-2026-5180

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-03T09:10:32Z

Weaknesses