Online Appointment Booking System EUVD-2025-21245

This vulnerability presents HIGH real-world risk despite a moderate CVSS 7.3 score. Risk signal analysis: (1) CVSS 7.3 with AV:N/AC:L/PR:N/UI:N indicates complete network exploitability requiring no privileges or user interaction, maximizing attack surface; (2) Public disclosure with available proof-of-concept code significantly elevates exploitation probability; (3) SQL injection on appointment records directly impacts confidentiality (patient data breach), integrity (appointment manipulation), and availability (DoS through destructive queries); (4) The 'unknown code' classification suggests potential for lateral movement or privilege escalation if the database user has elevated permissions; (5) SSVC considerations: Exploitation is ACTIVE (public POC exists), the attack is AUTOMATABLE (SQL injection tools), and technical impact is HIGH (complete database compromise possible). This is not a false-positive high-CVSS issue—it represents genuine critical risk in healthcare appointment systems handling protected health information (PHI).

An attacker discovers the vulnerable /cancelbookingpatient.php endpoint via public disclosure or reconnaissance. They craft a malicious request with a SQL injection payload in the 'appointment' parameter, such as: GET /cancelbookingpatient.php?appointment=1' UNION SELECT user(),database(),version()-- -. Since AV:N/AC:L/PR:N, no authentication or complex setup is required. The payload executes against the backend database, exfiltrating patient names, appointment details, contact information, or medical records. The attacker could escalate to INSERT/UPDATE statements to modify appointment records (e.g., changing doctor assignments or canceling critical appointments) or DELETE statements to destroy audit trails. With public POC code available, automated scanning tools can identify and exploit multiple instances across organizations using this software.