EUVD-2026-92631
GHSA-qv5r-3m7q-77xm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed login page over network
-
ExploitSubmit crafted uname/psw with SQL payload
-
ExecutionInjection executes in mysqli_query
-
ImpactBypass auth or extract patient data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the application's patient login endpoint (cover.php); the injection occurs in the uname/psw parameters of the Patient Login Handler before authentication, so no credentials, user interaction, or special configuration are needed (AV:N/AC:L/PR:N/UI:N) against a default deployment of Online-Appointment-Booking-System. The primary limiting factor is exposure and prevalence: the instance must be internet- or network-accessible, and the product is a niche open-source project with very few live deployments. No authenticated session or elevated privilege is required to trigger the flaw. |
| Impact | Signals are mixed and point to a low-to-moderate, opportunistic risk rather than an urgent priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated SQL injection, which maximizes ease of access, but the impact metrics are only partial (VC:L/VI:L/VA:L, SC:N/SI:N/SA:N) and the base score is a middling 5.5. The exploit maturity is E:P (proof-of-concept), consistent with the input flag that public exploit code exists; there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation - only demonstrated feasibility. The most important risk-limiting factor is deployment: this is an obscure open-source GitHub project (girishsaraf/Online-Appointment-Booking-System), so despite a trivially exploitable flaw the realistic blast radius is small and any exploitation is likely to be targeted or automated mass-scanning of the small population that runs it. Note two data caveats: EPSS is missing (cannot quantify exploitation probability), and the vendor has not responded, so no fix exists for a rolling-release project with no versioned releases. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted login request to cover.php with SQL metacharacters in the uname or psw parameter, injecting into the mysqli_query call of the Patient Login Handler. Because low-complexity public proof-of-concept exploit code exists, an attacker can automate authentication bypass or database extraction against any exposed instance. The partial CVSS impact (VC:L/VI:L/VA:L) suggests limited rather than full database compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Unauthenticated SQL injection in the patient login handler of girishsaraf's Online-Appointment-Booking-System lets remote attackers manipulate the uname and psw parameters processed by mysqli_query in cover.php. Publicly available exploit code exists - the flaw was disclosed via a public GitHub issue (issue #5) - and the maintainer has not responded or shipped a fix, so every deployment of the rolling-release project is potentially affected. The assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) confirms no credentials, user interaction, or special configuration are needed; the practical limiting factor is exposure, as this is a niche open-source project with few live instances, so CISA KEV does not list it and the overall risk is low-to-moderate and opportunistic rather than urgent.
RemediationAI
No vendor-released patch identified at time of analysis: the project was notified through the public GitHub issue but has not responded, and its rolling-release model publishes no fixed version, so there is no version number to upgrade to and no upstream commit to cite. Until a fix lands, apply compensating controls in this order. First, eliminate the attack surface by taking the patient login endpoint offline or restricting cover.php behind a VPN, reverse proxy allow-list, or HTTP authentication so only trusted networks reach it - the trade-off is loss of public booking access for legitimate patients. Second, if the application must stay public, deploy a WAF or reverse-proxy rule set that blocks SQL metacharacters and known injection patterns on the uname and psw parameters of cover.php, accepting that signature-based filtering can be bypassed by encoding tricks and requires tuning to avoid false positives on legitimate login attempts. Third, harden the backend by running the application's database account with least privilege (SELECT on required tables only, no FILE, no stacked queries) so an injection cannot read unrelated data or write files, though this reduces rather than removes the flaw. Fourth, fork and remediate the code directly: replace the string-concatenated mysqli_query() calls in cover.php with parameterized statements (mysqli_prepare/bind_param), which is the only true root-cause fix, and monitor the upstream repository and issue #5 for an official commit or release to adopt instead. Track the VulDB entries (https://vuldb.com/vuln/413581) for updates, since public exploit code already exists and the issue thread may attract further weaponized variants.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The target is a PHP web application whose patient login flow in cover.php builds SQL statements with the mysqli_query() function, concatenating the user-supplied uname and psw values directly into the query string. This is a classic CWE-89 improper neutralization of special elements used in SQL commands: because the login handler runs before authentication completes, an attacker can inject SQL syntax into either field to alter the query's logic, bypass credential checks, enumerate or extract database contents, and potentially modify data depending on the database account's privileges. The CPE entry cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:* uses a wildcard version, reflecting the project's rolling-release model in which individual affected/fixed version numbers are not published; the reference set points only to the upstream GitHub repository and the disclosure issue, with no vendor advisory or tagged patch release. Note that the CVSS:4.0 vector rates the same defect E:P (proof-of-concept exploit) with low confidentiality, integrity, and availability impact, matching the independent assessment's view that impact per instance is limited and depends on database privileges and data sensitivity.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated, low-complexity SQLi in a pre-auth login handler gives AV:N/AC:L/PR:N/UI:N; partial C/I/A reflect limited database read/write rather than full compromise.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the file cover.php of the component Patient Login Handler. The manipulation of the argument uname/psw results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB