Online Appointment Booking System EUVD-2025-21323

While the CVSS 3.1 score of 7.3 reflects high severity, the real-world risk is CRITICAL when evaluated holistically: (1) Attack Vector (AV:N) - remotely exploitable with no network segmentation required; (2) Attack Complexity (AC:L) - low complexity, basic SQL injection syntax suffices; (3) Privileges Required (PR:N) - no authentication needed, attacker can inject during login attempt itself; (4) User Interaction (UI:N) - no user action required; (5) Public POC/Disclosure - confirmed availability of working exploits significantly elevates EPSS probability; (6) Exploitability Status - publicly disclosed with active exploitation likely given the simplicity of SQL injection in legacy PHP applications. The CVSS vector undersells the actual impact: SQL injection in authentication context (uname/psw parameters) typically enables complete authentication bypass, unauthorized data access (CIA impact: C:L/I:L/A:L is conservative), and potential remote code execution if the database user has FILE privileges. This meets SSVC 'Exploitation Status: Proof-of-Concept' and 'Technical Impact: Total' criteria, warranting immediate patching.

An attacker crafts a malicious HTTP POST request to the login functionality targeting /cover.php with uname parameter set to: admin' OR '1'='1 and psw set to: anything. The application concatenates this unsanitized input into a SQL query like SELECT * FROM users WHERE uname='admin' OR '1'='1' AND psw='anything', which bypasses authentication and logs in as the first user (typically admin). Alternatively, attacker uses UNION-based injection: uname=admin' UNION SELECT username,password FROM users-- and extracts credentials. Given the public POC availability and low AC complexity, exploitation requires only basic HTTP request manipulation and takes seconds to execute. No specialized tools or deep SQL knowledge needed; script kiddies with basic SQL injection knowledge can immediately compromise affected instances.