EUVD-2026-98746
GHSA-5xp3-74rq-rwc5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed booking endpoint
-
ExploitSubmit crafted dateselected parameter
-
ExecutionTrigger SQL injection in query
-
ImpactExtract or modify booking database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a running instance of the Online-Appointment-Booking-System be network-reachable and that the changebookingstatus.php endpoint accept attacker-supplied input for the 'dateselected' argument; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no special configuration, and no user interaction are needed against a default deployment. The principal limiting factor is not a configuration prerequisite but exposure itself - the product is a niche open-source project with minimal production deployment, and because it uses a rolling-release model there is no fixed version to pin, so defenders must patch from the latest source rather than a release tag. |
| Impact | Multiple signals converge on this being a genuine but low-tier remote risk rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated SQL injection, which normally warrants urgency; however, the impact metrics are all Low (VC:L/VI:L/VA:L) and the base score is only 6.9 (Medium), reflecting limited data exposure/integrity/availability rather than full database compromise. The 'E:P' (Proof-of-Concept) exploit-maturity value aligns with the reported publicly available exploit, but there is NO CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation - exploitation status is 'publicly available exploit code exists', which must not be conflated with in-the-wild use. The decisive mitigating factor is prevalence: this is an individual developer's GitHub project (girishsaraf/Online-Appointment-Booking-System), not enterprise software, so real-world attack surface is minimal. Net: a real, confirmed-reproducible unauthenticated SQLi worth patching for anyone running this code, but a low operational priority given the tiny deployment footprint and absence of KEV/EPSS escalation signals. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to changebookingstatus.php with a malicious value in the 'dateselected' parameter, injecting SQL that the application concatenates into a query. A public proof-of-concept exists (referenced via the project's GitHub issue tracker), lowering the barrier to reproduction, allowing the attacker to read or tamper with booking data. Because CVSS complexity is Low and no privileges or user interaction are required, the request can be issued directly against an exposed instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated SQL injection in the girishsaraf Online-Appointment-Booking-System allows remote attackers to manipulate the 'dateselected' argument of changebookingstatus.php and thereby alter backend database queries, with the assessed impact limited to low confidentiality, integrity and availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists - the vulnerability is documented in public issue report and VulDB entries - but there is no confirmation of active exploitation (no CISA KEV listing was provided). Because the project follows a rolling-release model, no version-tagged release can be pinned as affected or fixed: the observable snapshot is up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5, the maintainer was informed via GitHub issue #11, and no response or fix has been published. Multiple signals converge on this being a genuine but low-tier remote risk rather than an emergency, since the product is a niche open-source project with minimal production deployment and exposure - not a configuration prerequisite - is the principal limiting factor.
RemediationAI
No vendor-released patch identified at time of analysis: the maintainer was notified through issue #11 but the project has not responded and, given the rolling-release model, no fixed commit or release tag has been published - so monitor https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/11 and the repository commit history for an upstream correction, and track https://vuldb.com/vuln/417184 for advisory updates. Because the vulnerable logic lives in the single script changebookingstatus.php and is driven by the 'dateselected' parameter, the most effective immediate mitigation is to confine that endpoint: apply a web-server rule (Apache Require/Deny or nginx allow/deny/location block) so only trusted networks or authenticated sessions can reach changebookingstatus.php, accepting the trade-off that legitimate booking-status changes from untrusted clients will fail until an upstream fix is deployed. In parallel, deploy a WAF or reverse-proxy rule that rejects requests whose dateselected value does not match a strict date pattern (e.g. ^[0-9]{4}-[0-9]{2}-[0-9]{2}$) and blocks SQL metacharacters and union/comment sequences, noting that over-strict patterns may reject date formats the application legitimately accepts, and that pattern filtering is a bypassable stopgap compared with parameterization. For anyone maintaining a fork, the durable fix is to rewrite the changebookingstatus.php query using prepared statements with bound parameters in place of string concatenation - a source-level change that must be verified against the app's booking-status workflow. Where the instance is a demo, test or internet-facing showcase rather than a production service, taking it offline or placing it behind a VPN is the lowest-risk option. Detection should focus on anomalous changebookingstatus.php requests carrying SQL syntax in the dateselected parameter.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code is a PHP web application, girishsaraf/Online-Appointment-Booking-System, identified by the CPE cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*, where the wildcard version reflects the project's rolling-release model rather than a pinned release. The flaw is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), classically arising when attacker-controlled input is concatenated into a SQL statement instead of being bound as a parameter. Here the sink is changebookingstatus.php and the controllable parameter is 'dateselected', a value that presumably feeds a booking-status update query - typically an UPDATE or SELECT against a bookings/appointments table. Because the CVSS vector carries PR:N and UI:N, and our independent assessment concurs (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), the injection is reachable without prior authentication or victim interaction on a default deployment, which is characteristic of a public-facing PHP endpoint that does not gate the status-change action. The CVSS 4.0 vector's E:P metric corresponds to proof-of-concept-level exploit maturity, matching the publicly available exploit data; the resulting impact is bounded (VC:L/VI:L/VA:L in 4.0, and C:L/I:L/A:L in our 3.1 re-assessment) rather than leading to full database compromise, which is consistent with a single injectable parameter on one script rather than a broad ORM or authentication bypass.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated SQLi via an HTTP parameter gives AV:N/AC:L/PR:N/UI:N; impact rated Low across C/I/A consistent with the input's limited-impact assessment rather than full DB takeover.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB