Appointment Booking System CVE-2026-109522

Exploitation targets the cid and did GET/POST parameters of the Admin/deleteclinic.php script in the Online-Appointment-Booking-System Admin CRUD component; the endpoint must be network-reachable (HTTP). The key limiting factor is access to the admin area: because this is an administrative script, exploitation likely depends on whether Admin/ pages enforce an authenticated admin session - the VulDB vector claims PR:N (no auth), but if session checks are present an attacker needs admin credentials first. No user interaction is required. Because versioning is rolling-release, there is no published fixed version, so remediation requires pulling the latest commit after the maintainer patches it (not yet done).

This is a classic SQL injection (CWE-89) in the cid/did parameters of Admin/deleteclinic.php within a small open-source PHP application. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) rates it as network-reachable, low-complexity, and unauthenticated, but the vulnerable file resides in an 'Admin CRUD Endpoint' - this is a direct conflict: VulDB's PR:N assumes no access control, yet an admin-panel script would normally require administrator authentication. Verify with the source whether Admin/ scripts enforce a session check; if they do, real-world risk is materially lower (attacker needs admin access first). The E:P in the vector plus the 'POC publicly available' signal indicate proof-of-concept exploit code exists (traceable to the GitHub issue reference), but there is NO CISA KEV listing and no EPSS score was supplied, so there is no evidence of active, widespread exploitation. The moderate 6.9 score and L/L/L impact reflect a limited-blast-radius flaw in a niche product rather than an enterprise-critical issue; combined with the project's tiny footprint and no vendor response, this is a low operational priority for most defenders despite the public POC.

A remote attacker sends a crafted HTTP request to Admin/deleteclinic.php with a malicious cid or did parameter containing SQL syntax, injecting into the backend query to read or manipulate database contents. Public proof-of-concept detail exists (disclosed via the project's GitHub issue tracker), lowering the skill required; if the admin endpoint lacks a session/auth check the request can be issued without credentials, otherwise the attacker must already hold admin-panel access.