Description
A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument doc_id results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Published: 2026-09-04
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an unsanitized user-controlled parameter in the booking.php endpoint that allows an attacker to inject arbitrary SQL via the doc_id argument. This can lead to unauthorized disclosure, modification, or deletion of patient data. The weakness is catalogued as CWE-74 (Improper Input Sanitization) and CWE-89 (SQL Injection).

Affected Systems

The affected product is code-projects Doctor Appointment System version 1.0, particularly the booking.php file under /patient/. No other products or versions are identified.

Risk and Exploitability

The CVSS score of 6.9 classifies the issue as medium severity, and no EPSS data is available. It is not listed in the CISA KEV catalog. Remote attackers can exploit the vulnerability if they can construct a request to booking.php with a crafted doc_id value; once injected, they can extract sensitive data or modify database entries. The absence of an official fix means the risk remains until a patch or mitigative configuration change is applied.

Generated by OpenCVE AI on September 4, 2026 at 04:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to the latest version of the Doctor Appointment System if one is released that includes proper input validation for the doc_id parameter.
  • If upgrading is not possible, refactor booking.php to use parameterized queries (prepared statements) or escape user input before embedding it into SQL statements.
  • Restrict external access to booking.php to trusted IP ranges or implement application-level authentication so that only authorized users can submit doc_id values.

Generated by OpenCVE AI on September 4, 2026 at 04:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 03:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument doc_id results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Title code-projects Doctor Appointment System booking.php sql injection
First Time appeared Code-projects
Code-projects doctor Appointment System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:doctor_appointment_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects doctor Appointment System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Doctor Appointment System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-04T03:00:13.193Z

Reserved: 2026-09-03T18:25:38.949Z

Link: CVE-2026-85402

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T03:17:46.863

Modified: 2026-09-04T03:17:46.863

Link: CVE-2026-85402

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T04:30:13Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')