Online-Appointment-Booking-System CVE-2026-105470

Exploitation requires that the target deploys the Online-Appointment-Booking-System with its Doctor Search feature (locateus.php) reachable over the network, and sends a malicious payload in the 'doctorname' request argument. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed, and it works against the default application flow - there is no special non-default configuration prerequisite. The practical limiting factor is exposure and deployment: this is a niche PHP application that must be publicly hosted to be attacked, and real data impact depends on the database account's privileges behind the mysqli connection.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, and the E:P (Proof-of-Concept) exploit maturity aligns with the input signal that publicly available exploit code exists. However, the vulnerable-system impacts are all rated Low (VC:L/VI:L/VA:L) and there is no scope change, which is why the base score lands at 6.9 (Medium) rather than Critical despite the trivially exploitable injection point. No EPSS score was provided, so exploitation-probability cannot be quantified; the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation - only a public POC. SSVC-style reasoning: exploitation is 'public/POC' (not 'active'), the flaw is plausibly automatable (unauthenticated web SQLi against a fixed endpoint), but technical impact is partial rather than total given the Low CIA ratings. The dominant mitigating factor is prevalence: this is an obscure personal GitHub project (girishsaraf/Online-Appointment-Booking-System), so despite easy exploitability this is a low real-world priority rather than a widespread emergency. Note the impact ratings are VulDB's conservative defaults - a real SQL injection could allow full database read, so the Low confidentiality rating may understate actual impact; verify against the specific query and DB privileges.

A remote, unauthenticated attacker sends a crafted value in the 'doctorname' parameter to the Doctor Search endpoint (locateus.php), which is concatenated into a mysqli_query call, injecting arbitrary SQL. Because a public POC exists (referenced via the project's GitHub issue tracker), the attacker can reliably extract or manipulate appointment/patient data from the backend database. The low attack complexity and lack of required authentication or user interaction make this directly reachable over the network against any exposed instance.