Which versions of PHP are affected by CVE-2026-5179?

SourceCodester Simple Doctors Appointment System 1.0 contains a critical SQL injection vulnerability in the administrative login interface that allows unauthenticated remote attackers to compromise…

Is there a public PoC exploit available for CVE-2026-5179?

Yes, a public proof-of-concept exploit is available for CVE-2026-5179. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5179?

Within 24 hours: Immediately disconnect or isolate any instances of SourceCodester Simple Doctors Appointment System 1.0 from internet access; implement Web Application Firewall (WAF) rules to block SQL injection patterns in the /admin/login.php Username parameter. Within 7 days: Conduct database audit to identify unauthorized access or modifications since deployment; evaluate alternative appointment management systems with security patch support. Within 30 days: Complete migration to patched or alternative software; establish vendor security update monitoring process for all third-party applications.

PHP CVE-2026-5179

Q: What is the CVSS score of CVE-2026-5179?

CVE-2026-5179 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17311 MEDIUM

SQL Injection (CWE-89)

2026-03-31 VulDB

GHSA-3px2-4mjj-vhr8

PHP SQLi Simple Doctors Appointment System Sourcecodester

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 01, 2026 - 14:24 vuln.today

Public exploit code

EUVD ID Assigned

Mar 31, 2026 - 04:30 euvd

EUVD-2026-17311

Analysis Generated

Mar 31, 2026 - 04:30 vuln.today

CVE Published

Mar 31, 2026 - 04:00 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This affects an unknown part of the file /admin/login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Simple Doctors Appointment System 1.0 allows remote unauthenticated attackers to extract, modify, or delete database contents via the Username parameter in /admin/login.php. Publicly available exploit code exists (GitHub POC), enabling trivial exploitation with no authentication required. CVSS 7.3 reflects low attack complexity and network accessibility. EPSS data unavailable, but public POC significantly elevates real-world risk for internet-facing installations.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based web application. The affected component is the admin login form (/admin/login.php) in SourceCodester Simple Doctors Appointment System version 1.0. SQL injection occurs when user-supplied input (the Username parameter) is improperly sanitized before being concatenated into SQL queries executed against the backend database. Attackers can inject malicious SQL syntax to manipulate query logic, bypass authentication, extract sensitive data (patient records, credentials), modify database contents, or execute administrative operations. The CPE identifier (cpe:2.3:a:sourcecodester:simple_doctors_appointment_system:*:*:*:*:*:*:*:*) confirms this is a SourceCodester-authored open-source PHP application commonly downloaded by educational institutions and small clinics for appointment management workflows.

RemediationAI

No vendor-released patch identified at time of analysis. SourceCodester has not published an official security advisory or patched version per available references. Immediate mitigation steps: (1) Remove the application from internet-facing servers or place behind VPN/firewall to restrict network access. (2) Implement web application firewall (WAF) rules to block SQL injection patterns targeting the Username parameter in /admin/login.php. (3) Apply input validation and parameterized queries (prepared statements) to the affected PHP code manually if source modification is feasible-review https://github.com/dyh1213-wq/cve/issues/3 for exploit details to understand injection points. (4) Monitor VulDB advisory https://vuldb.com/vuln/354247 and vendor site https://www.sourcecodester.com/ for future patch releases. Organizations should prioritize replacing this application with actively maintained, security-audited alternatives for production healthcare environments.