Online Appointment Booking System
CVE-2025-7765
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker sends crafted HTTP POST to /admin/addmanagerclinic.php with SQL payload in clinic parameter
-
DeliverySQL injection in database query
-
ExploitAttacker extracts database contents (e.g., user credentials)
-
ExecutionUnauthorized access to admin panel
-
ImpactFull control over application data.
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against the /admin/addmanagerclinic.php endpoint without any authentication required (PR:N from CVSS vector). The only requirement is that the target server is running the vulnerable Online Appointment Booking System 1.0 and the endpoint is reachable over the network. No user interaction is needed. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) indicates a medium severity (score 5.5) due to low impact on confidentiality, integrity, and availability. While the exploit is publicly available, the EPSS score of 0.07% (20th percentile) suggests a low probability of exploitation in the wild, and there is no CISA KEV listing. The product is a niche, volunteer-developed PHP application, so the real-world risk is low for most organizations but critical for any instance running this software. The conflicting signals (public exploit vs. low EPSS) reflect the software's obscure footprint rather than the vulnerability's severity. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a specially crafted HTTP POST request to /admin/addmanagerclinic.php with a malicious SQL payload in the clinic parameter, such as ' OR '1'='1. The application executes the query, allowing the attacker to extract sensitive data (e.g., admin credentials) from the database. The publicly available exploit code from GitHub makes this easily reproducible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the clinic parameter in /admin/addmanagerclinic.php. The vulnerability has a publicly available proof-of-concept exploit, though EPSS probability is low (0.07%) and it is not listed in CISA KEV, indicating limited active exploitation in the wild.
RemediationAI
No vendor-released patch is identified at the time of analysis. As a workaround, restrict access to the vulnerable /admin/addmanagerclinic.php endpoint using .htaccess, web server configuration, or a firewall rule to allow only authorized IPs. Additionally, implement strict input validation (type casting, parameterized queries) if modifying the source code. Disclosure of the vulnerability on GitHub (https://github.com/jaynewboy/cve/issues/1) may lead to future fixes, but no official update from code-projects.org has been observed.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is a classic SQL injection (CWE-74) in a PHP-based web application, specifically the administrative endpoint /admin/addmanagerclinic.php. The application uses a backend database (likely MySQL) and fails to sanitize the 'clinic' POST parameter before constructing SQL queries. The affected software is identified by CPE cpe:2.3:a:anisha:online_appointment_booking_system:1.0, distributed via code-projects.org. SQL injection of this nature can allow attackers to extract, modify, or delete database contents depending on database permissions.
Know when Online Appointment Booking System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated SQLi with low impact.
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
A vulnerability classified as critical was found in code-projects Online Appointment Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/addmanagerclinic.php. The manipulation of the argument clinic leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
Missing authorization in the Admin/showdoctor.php admin display page of girishsaraf's Online-Appointment-Booking-System
SQL injection in the Admin/deleteclinic.php endpoint of girishsaraf's Appointment Booking System allows remote attackers
SQL injection in the girishsaraf Online-Appointment-Booking-System (rolling release) lets unauthenticated remote attacke
Unauthenticated SQL injection in the patient login handler of girishsaraf's Online-Appointment-Booking-System lets remot
SQL injection in the Admin/getclinic.php AJAX endpoint of girishsaraf's Online-Appointment-Booking-System lets remote at
Unauthenticated SQL injection in the signup.php registration handler of girishsaraf Online-Appointment-Booking-System le
Unauthenticated SQL injection in the Doctor Search endpoint (locateus.php) of girishsaraf's Online-Appointment-Booking-S
Unauthenticated SQL injection in the administrative login handler (Admin/mlogin.php) of girishsaraf's Online-Appointment
We are tasked with synthesizing a JSON analysis for CVE-2025-7752. Let's collect data: - CVE ID: CVE-2025-7752 - Descri
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to manipula
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to execute arbitrary SQL co
SQL injection in Online Appointment Booking System 1.0 allows remote attackers to manipulate the clinic parameter in /ad
Exploit-DB