Which versions of PHP are affected by CVE-2026-5180?

SourceCodester Simple Doctors Appointment System 1.0 contains a critical SQL injection vulnerability in the login endpoint that allows unauthenticated attackers to bypass authentication and access…

Is there a public PoC exploit available for CVE-2026-5180?

Yes, a public proof-of-concept exploit is available for CVE-2026-5180. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5180?

Within 24 hours: Identify all instances of SourceCodester Simple Doctors Appointment System 1.0 in production and development; document affected systems and data sensitivity. Within 7 days: Implement network-level access controls restricting /admin/ajax.php to trusted IP ranges only; consider taking affected systems offline if patient-facing services can be maintained alternatively. Within 30 days: Evaluate migration to a patched alternative appointment system or contact vendor for security roadmap; request proof of remediation before upgrading if vendor releases a patch.

PHP CVE-2026-5180

Q: What is the CVSS score of CVE-2026-5180?

CVE-2026-5180 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17313 MEDIUM

SQL Injection (CWE-89)

2026-03-31 VulDB

PHP SQLi Simple Doctors Appointment System Sourcecodester

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 01, 2026 - 14:24 vuln.today

Public exploit code

EUVD ID Assigned

Mar 31, 2026 - 04:30 euvd

EUVD-2026-17313

Analysis Generated

Mar 31, 2026 - 04:30 vuln.today

CVE Published

Mar 31, 2026 - 04:00 nvd

MEDIUM 6.9

DescriptionCVE.org

A flaw has been found in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=login2. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in SourceCodester Simple Doctors Appointment System 1.0 allows unauthenticated remote attackers to compromise confidentiality, integrity, and availability via the /admin/ajax.php login endpoint. Attackers manipulate the 'email' parameter to execute arbitrary SQL commands. Publicly available exploit code exists (GitHub POC published), significantly lowering the attack barrier. The CVSS score of 7.3 reflects network-based exploitation requiring low complexity and no privileges, with partial impact across all CIA triad elements. No CISA KEV listing at time of analysis, but the combination of public exploit and authentication bypass capability makes this a realistic threat to internet-facing instances.

Technical ContextAI

This vulnerability stems from improper neutralization of special elements in SQL commands (CWE-89), a classic injection flaw in web applications. The affected component is /admin/ajax.php in the login2 action handler, where user-supplied input from the 'email' parameter is concatenated directly into SQL queries without parameterization or adequate sanitization. SourceCodester Simple Doctors Appointment System is a PHP-based web application for managing medical appointments, typically deployed with MySQL/MariaDB backends. The CPE identifier (cpe:2.3:a:sourcecodester:simple_doctors_appointment_system) confirms this is a SourceCodester product. SQL injection at the authentication layer is particularly severe because attackers can bypass login mechanisms entirely, extract database contents (including credentials, patient records), modify data, or escalate to operating system command execution depending on database permissions and configuration. The PHP ecosystem's historical challenges with SQL injection - often due to use of deprecated mysql_* functions or improper use of mysqli/PDO - likely contributed to this flaw.

RemediationAI

No vendor-released patch identified at time of analysis. SourceCodester products are often distributed as educational code samples without ongoing security maintenance or formal patch cycles. Organizations should immediately implement defense-in-depth controls: first, restrict network access to the /admin/ directory using IP whitelisting, VPN requirements, or removing public exposure entirely. Second, deploy a web application firewall (WAF) with SQL injection signatures targeting the vulnerable endpoint - rules should inspect POST parameters to /admin/ajax.php for SQL metacharacters and injection patterns. Third, conduct code review of the login2 function in ajax.php and implement parameterized queries using PDO prepared statements or mysqli_prepare functions to sanitize the email parameter. For organizations unable to modify the code, consider replacing the application with a maintained alternative that receives security updates. Monitor for the GitHub POC exploit pattern (available at github.com/dyh1213-wq/cve/issues/4) in web access logs. Additional vulnerability intelligence available through VulDB entries 354248 at vuldb.com/vuln/354248. If the application stores protected health information (PHI), treat this as a potential HIPAA breach incident requiring risk assessment per regulatory requirements.