EUVD-2026-70874
GHSA-64x9-gjg3-mmm2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP POST to /contactus.php
-
DeliveryInject SQL payload into `firstname` parameter
-
ExploitBypass absent input sanitization
-
ExecutionExecute attacker-controlled SQL on backend database
-
ImpactExtract or manipulate database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required - remote unauthenticated exploitation is possible against any default deployment of Doctor Appointment System 1.0 reachable over the network. The |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/E:P) confirms trivial remote exploitation with no authentication, no complexity barriers, and a confirmed public exploit. The E:P modifier directly reflects the GitHub PoC linked in the references. The base impact metrics (VC:L/VI:L/VA:L) are moderate, likely reflecting the limited database scope of a contact-form handler; however, real-world SQL injection impact is highly configuration-dependent - if the database user has broader privileges, full schema enumeration or data manipulation is plausible. This CVE is not in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis. The product's niche footprint (educational hobby project) constrains aggregate exposure, but any deployed instance is fully exploitable from the internet with publicly available tooling. The combination of zero-authentication network access and a published PoC makes this a high-priority patch for any operator running this software. |
| Exploit ScenarioDerived | An unauthenticated attacker submits an HTTP POST request to |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
SQL injection in code-projects Doctor Appointment System 1.0 permits unauthenticated remote attackers to manipulate backend database queries by supplying crafted input in the firstname parameter of /contactus.php. The flaw (CWE-89) stems from unsanitized user input concatenated directly into SQL statements, enabling data extraction or modification without any credentials. A public proof-of-concept exploit is available on GitHub, reducing the barrier for opportunistic attacks despite a moderate CVSS 4.0 score of 6.9.
RemediationAI
No vendor-released patch has been identified at time of analysis. The definitive fix is to rewrite the SQL query in /contactus.php to use prepared statements with parameterized inputs for the firstname field, replacing any direct string concatenation - this eliminates the root cause with no functional impact on the contact form. As an immediate compensating control, deploy WAF rules to block common SQL injection payloads (e.g., single-quote sequences, UNION/SELECT keywords) targeting the firstname parameter on /contactus.php; note that WAF rules are bypassable via encoding and obfuscation techniques and must not be treated as a permanent fix. Additionally, restrict the database account used by the application to the minimum required privileges (e.g., SELECT-only on the contacts table), which limits the blast radius of a successful injection. If the application is not actively maintained and a patch is not forthcoming, consider decommissioning in favor of a maintained alternative. References: https://vuldb.com/vuln/398546, https://github.com/lccc-t/CVE/issues/6.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is Doctor Appointment System 1.0, a PHP-based web application distributed by code-projects (code-projects.org), an open-source educational software platform. The CPE cpe:2.3:a:code-projects:doctor_appointment_system:*:*:*:*:*:*:*:* covers all released versions with no patched build identified. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the firstname parameter submitted to /contactus.php is concatenated directly into a SQL query without parameterized queries or adequate escaping. Because the contact form endpoint is publicly accessible by design, no authentication is needed to reach the injection point. The PHP runtime passes the malformed query directly to the underlying relational database, allowing an attacker to control query logic.
Know when Doctor Appointment System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable public contact form, no auth or interaction required; limited C/I/A impact consistent with contact-form database scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in code-projects Doctor Appointment System 1.0. This issue affects some unknown processing of the file /contactus.php. This manipulation of the argument firstname causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in code-projects Doctor Appointment System SQL Injection
View all 2More in Doctor Appointment System
View allSourcecodester Doctor Appointment System 1.0 is vulnerable to SQL Injection in the variable $userid at doctors\myDetails
Doctormms v1.0 was discovered to contain a SQL injection vulnerability via the $userid parameter at myAppoinment.php. Ra
SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL q
Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malic
Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malic
Blind SQL injection in contactus.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malic
Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malic
A vulnerability classified as critical was found in projectworlds Online Doctor Appointment Booking System 1.0. Rated me
A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. Rated medium severity (CVSS 6.9
SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated
Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to in
Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to in
Exploit-DB