Online-Appointment-Booking-System CVE-2026-105469

Requires a network-reachable deployment of the Online-Appointment-Booking-System exposing the get_town.php AJAX endpoint; exploitation is achieved by manipulating the countryid, townid, cid, didval, or cidval request parameters, with no authentication or user interaction needed per PR:N/UI:N. The primary limiting factor is deployment scarcity - this is an obscure single-maintainer project unlikely to be exposed at scale - rather than any technical precondition; any reachable default instance appears exploitable.

Signals are mixed and point to a low-to-moderate real-world priority. The supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, but the impact sub-metrics are all Low (VC:L/VI:L/VA:L) and the score is only 6.9, indicating partial rather than full database compromise as assessed by the reporter. The E:P (Proof-of-Concept) exploit maturity flag and the 'POC publicly available' intelligence confirm exploit code exists, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation - exploitation status is 'publicly available exploit code exists,' which must not be conflated with in-the-wild activity. The affected software is a single-developer open-source GitHub project (girishsaraf/Online-Appointment-Booking-System) reported solely by VulDB, with the maintainer not yet responding, so the realistic threat is opportunistic scanning of the rare internet-exposed instance rather than a broad enterprise campaign. Key missing data stated explicitly: no EPSS probability was provided, no KEV status, and the vendor has issued no advisory or patch, so patch availability is unconfirmed.

A remote, unauthenticated attacker sends a crafted HTTP request to the get_town.php AJAX endpoint, tampering with the countryid, townid, cid, didval, or cidval parameters to inject SQL. Because the endpoint accepts attacker-controlled input directly into a query (CWE-89), the attacker can read or manipulate backend database records. A public proof-of-concept is referenced via the project's GitHub issue, lowering the skill barrier to reproduce the attack.