Online Appointment Booking System EUVD-2025-21268

The CVSS 3.1 score of 7.3 reflects High severity with network-based attack vector (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), and no user interaction (UI:N), indicating broad exploitability. The score accurately reflects the vulnerability's ease of exploitation—any remote user can craft malicious SQL in the townid parameter. However, the impact is limited to Low across confidentiality, integrity, and availability (C:L/I:L/A:L), suggesting database queries can leak data or be manipulated but may not achieve complete system compromise. The public disclosure and available exploit code elevate real-world risk significantly. Without KEV/EPSS data explicitly provided, the public POC availability and unauthenticated attack vector suggest this should be treated as actively exploitable with high exploitation likelihood. The automatable nature (no user interaction required) and remote attack vector make this suitable for automated scanning and mass exploitation by threat actors. This is a HIGH PRIORITY vulnerability for any organization running affected versions—it's trivially exploitable but not catastrophic in isolation.

An attacker identifies an Online Appointment Booking System 1.0 instance via public web scanning or reconnaissance. They craft a request to /getclinic.php?townid=1 UNION SELECT username,password,email FROM users-- to extract user credentials from the database. Since AC:L and PR:N, the attacker requires no special privileges—they can immediately send this request from any network location. The SQL injection executes within the application's database context, potentially exposing clinic data, user information, or allowing UPDATE/DELETE commands to modify records. With publicly available POC code, attacks can be automated across multiple targets. A more severe variant might use INTO OUTFILE to write files or execute stored procedures if database permissions allow. The lack of authentication (PR:N) means mass exploitation of all exposed instances is feasible.