Online Appointment Booking System
CVE-2025-14833
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to /admin/deletemanagerclinic.php with malicious 'clinic' parameter
-
ExploitTrigger SQL injection vulnerability
-
ExecutionExecute arbitrary SQL queries against the database
-
ImpactExfiltrate, modify, or delete data resulting in low confidentiality, integrity, and availability impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0. |
| Impact | CVSS 4.0 indicates low impact (VC:L/VI:L/VA:L) with network attack vector, no privileges, and no user interaction. EPSS score of 0.04% suggests low likelihood of widespread exploitation. No CISA KEV listing and the product's niche open-source nature point to minimal real-world risk. While the vulnerability is easily triggerable with a public proof-of-concept, the low impact and limited deployment make it a low-priority issue for most organizations. There is no contradiction between the CVSS severity and EPSS; the low impact reduces overall urgency despite easy exploitation. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted HTTP request to /admin/deletemanagerclinic.php with a malicious SQL payload in the 'clinic' parameter, exploiting the injection to extract sensitive data from the database, modify records, or cause denial of service. A publicly available exploit simplifies this attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to manipulate the 'clinic' parameter in /admin/deletemanagerclinic.php, leading to unauthorized data access, modification, or deletion. A public exploit is available, though no active exploitation has been confirmed (not in CISA KEV), and EPSS indicates low (0.04%) exploitation probability.
RemediationAI
No vendor-released patch has been identified at time of analysis. As a workaround, restrict access to /admin/deletemanagerclinic.php to trusted administrators via IP whitelisting or web server access controls, or disable the endpoint entirely. Apply parameterized queries or strict input validation to the 'clinic' parameter. Monitor the VulDB entry (https://vuldb.com/?id.336982) and GitHub issue for updates.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in a PHP web application (anisha:online_appointment_booking_system version 1.0) that uses SQL databases. The /admin/deletemanagerclinic.php script fails to properly neutralize special elements in the 'clinic' parameter before using it in an SQL query, resulting in an injection flaw classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). This allows attackers to embed arbitrary SQL code.
Know when Online Appointment Booking System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network vector, low complexity, no privileges; low impact on confidentiality, integrity, and availability.
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
A security flaw has been discovered in code-projects Online Appointment Booking System 1.0. The impacted element is an unknown function of the file /admin/deletemanagerclinic.php. Performing manipulation of the argument clinic results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
Missing authorization in the Admin/showdoctor.php admin display page of girishsaraf's Online-Appointment-Booking-System
SQL injection in the Admin/deleteclinic.php endpoint of girishsaraf's Appointment Booking System allows remote attackers
SQL injection in the girishsaraf Online-Appointment-Booking-System (rolling release) lets unauthenticated remote attacke
Unauthenticated SQL injection in the patient login handler of girishsaraf's Online-Appointment-Booking-System lets remot
SQL injection in the Admin/getclinic.php AJAX endpoint of girishsaraf's Online-Appointment-Booking-System lets remote at
Unauthenticated SQL injection in the signup.php registration handler of girishsaraf Online-Appointment-Booking-System le
Unauthenticated SQL injection in the Doctor Search endpoint (locateus.php) of girishsaraf's Online-Appointment-Booking-S
Unauthenticated SQL injection in the administrative login handler (Admin/mlogin.php) of girishsaraf's Online-Appointment
We are tasked with synthesizing a JSON analysis for CVE-2025-7752. Let's collect data: - CVE ID: CVE-2025-7752 - Descri
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to manipula
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to execute
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to execute arbitrary SQL co
Exploit-DB