EUVD-2026-98741
GHSA-6j4w-8cgr-q7j9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed booking endpoint
-
DeliveryCraft request with username[]/timestamp[]/status[] arrays
-
ExploitBypass missing authorization check
-
ExecutionModify arbitrary appointment status
-
ImpactIntegrity/availability impact on bookings
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - the changebookingstatus.php submit2 handler performs no authorization check, so a remote unauthenticated attacker can manipulate the username[], timestamp[], and status[] array arguments against a default deployment of the Online-Appointment-Booking-System to change other users' booking statuses. Limiting factors: the application instance must be network-accessible (internet- or LAN-exposed), and real-world exposure is constrained by the product's negligible deployment footprint rather than by any configuration or authentication prerequisite; impact is bounded to appointment booking data (no system-level or confidentiality-of-secrets impact indicated). |
| Impact | This is a moderate-risk, limited-impact issue rather than a top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated flaw, and the E:P maturity flag plus the VulDB-referenced GitHub issue confirm that proof-of-concept exploit code exists - but all three impact dimensions are Low (VC:L/VI:L/VA:L) and scope is unchanged (SC:N/SI:N/SA:N), which is why the score lands at only 6.9. There is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - exploit availability (a distinct signal) should not be conflated with exploitation in the wild. The dominant risk-dampening factor is prevalence: this is an obscure open-source hobby project on GitHub, not enterprise software, so real-world exposure is minimal. Net assessment: a genuine unauthenticated missing-authorization bug with public POC, but low technical impact and tiny deployment footprint make it a low operational priority for most defenders. Note a classification nuance - the CWE is CWE-862 (Missing Authorization), whereas the input Tags label it 'Authentication Bypass'; these are related but distinct concepts and should be verified against the actual code path. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted POST request to changebookingstatus.php (the submit2 handler), supplying attacker-chosen username[], timestamp[], and status[] array parameters to alter the booking status of appointments belonging to other users without any authorization check. A public proof-of-concept is referenced via the project's GitHub issue tracker, and because CVSS reports AV:N/AC:L/PR:N/UI:N, no authentication, special network position, or user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Remote unauthenticated attackers can alter other users' appointment booking statuses in girishsaraf's Online-Appointment-Booking-System because the changebookingstatus.php submit2 handler lacks authorization checks (CWE-862). Publicly available exploit code exists, but the issue is assessed as moderate-risk and limited-impact - affecting only booking data - with the product's negligible deployment footprint constraining real-world exposure. No vendor patch has been released, and the project has not responded to the reported issue.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project has not responded to the issue report, and the rolling release model means no fixed version is disclosed. Until a patch is available, organizations should implement compensating controls: restrict network access to the application (e.g., place it behind a VPN or firewall allowlist) to prevent unauthenticated remote exploitation - trade-off: limits legitimate remote booking. Alternatively, enforce authentication/authorization at the web server or reverse proxy level for changebookingstatus.php (e.g., HTTP Basic Auth or session validation) - trade-off: may disrupt legitimate users and integrations. If the status-change functionality is not essential, disable or remove changebookingstatus.php - trade-off: breaks booking status updates. A WAF rule blocking POST requests with array parameters (username[], timestamp[], status[]) to changebookingstatus.php can provide interim protection - trade-off: requires tuning to avoid false positives. Because the flaw is missing authorization, the most robust fix is to add proper session and role checks in the submit2 handler, but this requires code changes that the upstream project has not made. Given the limited impact (booking data only) and negligible deployment footprint, the risk is moderate; monitor logs for anomalous booking status changes. Refer to the VulDB entry (https://vuldb.com/vuln/417189) for updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Online-Appointment-Booking-System is a PHP web application. The vulnerability resides in the changebookingstatus.php file, specifically the 'submit2' handler, which processes HTTP requests containing array parameters username[], timestamp[], and status[]. The root cause is CWE-862 (Missing Authorization): the handler does not verify that the requester is authenticated or has permission to modify booking records, allowing an attacker to craft requests that change the status of arbitrary bookings. This is an access control flaw (not code injection or memory corruption) and is remotely exploitable without authentication (CVSS vector PR:N). The affected product is identified by CPE cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*, covering all versions up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5; the project uses a rolling release model and does not disclose version numbers, so no fixed version has been identified.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated missing-authorization flaw (AV:N/AC:L/PR:N/UI:N) with limited read/modify impact on booking records only, so C/I/A are each Low and scope unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB