Online Appointment Booking System CVE-2025-7539

CVSS 7.3 (Medium-High severity) with AV:N/AC:L/PR:N/UI:N indicates network-exploitable, low-complexity, unauthenticated attack surface—all high-risk characteristics. However, CVSS scope unchanged (S:U) and impact split across confidentiality, integrity, and availability (C:L/I:L/A:L) suggests moderate rather than complete compromise per query. The public disclosure and confirmed POC availability significantly elevate real-world risk beyond CVSS score alone. SQL injection on appointment systems directly threatens patient privacy (PHI/PII exposure), appointment data integrity, and service availability. Given the lack of authentication requirements (PR:N), this is immediately actionable by any internet-connected attacker. The CVSS 7.3 combined with public POC availability and remote unauthenticated vector makes this a HIGH priority for systems still running v1.0. Organizations should treat this as critical despite the sub-8.0 CVSS due to exploitation maturity and likely high volume of affected systems in production.

An unauthenticated attacker discovers a public deployment of code-projects Online Appointment Booking System v1.0 (e.g., www.clinic.example.com/appointments/). Attacker crafts a request to /getdoctordaybooking.php?cid=1' OR '1'='1 (or similar SQL injection payload). The vulnerable endpoint concatenates this unsanitized input directly into a SQL query such as SELECT * FROM bookings WHERE clinic_id = [UNSANITIZED_CID]. The injected SQL bypasses the WHERE clause logic, returning all bookings across all clinics. Attacker escalates to UNION-based injection to extract sensitive columns (patient names, phone numbers, addresses, appointment times). Advanced attacker extracts database schema, identifies admin tables, and potentially updates appointment records or inserts fraudulent entries. Since PR:N (no authentication required), attack requires only network access and basic SQL injection knowledge. POC code is publicly available, enabling even script-kiddies to perform automated scanning and exploitation across multiple targets. No user interaction required (UI:N). Attack succeeds in seconds.