Online Appointment Booking System EUVD-2025-21248

This vulnerability presents HIGH real-world risk across multiple threat indicators: (1) CVSS 7.3 reflects network-accessible, unauthenticated exploitation (AV:N, PR:N, UI:N) with moderate complexity (AC:L), resulting in confidentiality, integrity, and availability impacts; (2) Public disclosure with functional POC significantly accelerates exploitation probability and lowers attacker skill requirements; (3) The lack of authentication requirements (PR:N) and user interaction (UI:N) means automated exploitation at scale is trivial; (4) SQL injection in appointment booking systems typically exposes personally identifiable information, appointment details, and potentially payment/credentials data; (5) A small business or healthcare provider running version 1.0 likely lacks security monitoring, creating an extended window for undetected compromise. The primary risk signal is exploit availability and public disclosure status rather than CVSS alone—this moves from theoretical to operational risk immediately upon disclosure. SSVC framework would score this as EXPLOITATION:ACTIVE, AUTOMATABLE:YES, TECHNICAL_IMPACT:TOTAL, suggesting immediate patching required.

An attacker discovers a public-facing Online Appointment Booking System instance running version 1.0. They craft a malicious HTTP request to /getDay.php with a SQL injection payload in the cidval parameter, such as: GET /getDay.php?cidval=1' UNION SELECT user_login, user_pass, user_email FROM wp_users WHERE '1'='1 (or similar depending on the database schema). The application, lacking input sanitization, executes the injected SQL alongside the intended query, returning sensitive data (usernames, password hashes, emails, appointment details, customer contact information) in the HTTP response. Using this data, the attacker could: (1) crack password hashes to gain admin access; (2) harvest customer PII for identity theft or targeted phishing; (3) modify appointment records to disrupt service; (4) escalate to remote code execution if FILE WRITE permissions exist; (5) establish persistence by creating backdoor admin accounts. Given public POC availability, this could be automated for mass exploitation of vulnerable instances within hours of disclosure. A typical target would be a small medical clinic, salon, or consulting firm using this system without security expertise or monitoring.