Online Appointment Booking System
CVE-2025-7751
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess admin endpoint
-
DeliverySend crafted cid parameter
-
ExploitTrigger SQL injection
-
ExecutionExecute malicious queries
-
ImpactExtract or modify database data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated access to the /admin/addclinic.php endpoint is sufficient, as indicated by the CVSS vector (PR:N). However, the endpoint is part of an admin panel, and some deployments may impose additional access controls (e.g., authentication or IP restrictions). These factors could limit exploitation in hardened environments. The specific prerequisite is the ability to send HTTP requests to the vulnerable endpoint. |
| Impact | CVSS 4.0 base score of 5.5 (medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L indicates low impact on confidentiality, integrity, and availability. EPSS score is 0.07% (21st percentile), suggesting low exploitation likelihood. Public exploit code is available via GitHub, but no CISA KEV listing exists. SSVC assessment: exploitation status is ‘public exploit’, automatable due to low attack complexity, and technical impact is limited to low-level data compromise. Overall, this is a real but low-priority risk unless the system is exposed to untrusted networks. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request to /admin/addclinic.php with a malicious cid parameter containing SQL injection payloads. Using the publicly available exploit code, the attacker can extract or modify database contents, such as appointment records or administrator credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to manipulate database queries via the cid parameter in /admin/addclinic.php. Public exploit code exists, but exploitation probability is low (EPSS 0.07%) and no active exploitation has been confirmed.
RemediationAI
No vendor-released patch has been identified for this specific vulnerability. As a workaround, restrict network access to the /admin/addclinic.php endpoint using IP whitelisting or require authentication for admin pages. Deploy a web application firewall (WAF) with rules to block common SQL injection patterns. These mitigations may disrupt legitimate admin functionality if not carefully configured. Regularly monitor access logs for suspicious queries to the admin panel.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a SQL injection in a PHP-based web application, specifically in the admin panel endpoint /admin/addclinic.php. The cid parameter is passed to a database query without proper sanitization, allowing an attacker to inject arbitrary SQL commands. The root cause class is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected product is identified by CPE cpe:2.3:a:anisha:online_appointment_booking_system:1.0.
Know when Online Appointment Booking System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote network vector, low complexity, no privileges, low impact on confidentiality, integrity, and availability.
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
A vulnerability has been found in code-projects Online Appointment Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/addclinic.php. The manipulation of the argument cid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
Missing authorization in the Admin/showdoctor.php admin display page of girishsaraf's Online-Appointment-Booking-System
SQL injection in the Admin/deleteclinic.php endpoint of girishsaraf's Appointment Booking System allows remote attackers
SQL injection in the girishsaraf Online-Appointment-Booking-System (rolling release) lets unauthenticated remote attacke
Unauthenticated SQL injection in the patient login handler of girishsaraf's Online-Appointment-Booking-System lets remot
SQL injection in the Admin/getclinic.php AJAX endpoint of girishsaraf's Online-Appointment-Booking-System lets remote at
Unauthenticated SQL injection in the signup.php registration handler of girishsaraf Online-Appointment-Booking-System le
Unauthenticated SQL injection in the Doctor Search endpoint (locateus.php) of girishsaraf's Online-Appointment-Booking-S
Unauthenticated SQL injection in the administrative login handler (Admin/mlogin.php) of girishsaraf's Online-Appointment
We are tasked with synthesizing a JSON analysis for CVE-2025-7752. Let's collect data: - CVE ID: CVE-2025-7752 - Descri
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to execute
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to execute arbitrary SQL co
SQL injection in Online Appointment Booking System 1.0 allows remote attackers to manipulate the clinic parameter in /ad
Exploit-DB