Online Appointment Booking System CVE-2026-109523

Exploitation requires the attacker to reach the Admin/getclinic.php AJAX endpoint and supply attacker-controlled input in the city or cid argument, which is passed unsanitized into a SQL query. The decisive limiting factor is whether the Admin/ panel enforces authentication: the file path implies an administrative area (which would require a valid admin session), but VulDB scored it PR:N as if no authentication is needed - defenders should confirm against the deployed instance. Additional limiters are that the target must be an exposed, running instance of this specific rolling-release application, which has minimal real-world deployment.

This is a SQL injection flaw (CWE-89) in girishsaraf's Online-Appointment-Booking-System, affecting the city/cid parameters of Admin/getclinic.php. The supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) rates it 6.9 (Medium) with network-reachable, low-complexity, no-privilege, no-interaction access, and impacts rated Low across confidentiality/integrity/availability (VC:L/VI:L/VA:L). The E:P value plus the GitHub issue reference confirms publicly available exploit code exists, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The most important conflict: the vulnerable file lives under an Admin/ directory, which strongly implies an authenticated administrative context, yet VulDB scored it PR:N (unauthenticated) - verify with the code whether the admin panel enforces authentication, because this single decision swings real risk from 'any remote attacker' to 'authenticated admin only.' On balance this is a low-priority issue in practice: it is a rolling-release hobby/student project with negligible production footprint, the vendor has not responded, and despite a public PoC there is no indication of real-world targeting. Treat the Medium CVSS as a theoretical ceiling, not an operational emergency.

A remote attacker sends a crafted HTTP request to the Admin/getclinic.php AJAX endpoint, injecting SQL metacharacters into the city or cid argument to manipulate the backend query and extract or alter database records such as clinic, appointment, or user data. A public proof-of-concept is already published in the project's GitHub issue tracker, lowering the skill needed to reproduce it; low attack complexity (AC:L) means the request succeeds reliably once the endpoint is reachable.