edoc-doctor-appointment-system EUVD-2026-109604

Exploitation targets the 'spec' argument of the admin/add-new.php script specifically; the attacker must be able to reach this administrative page over the network. The key limiting/unresolved factor is authentication: because the script resides in the admin/ directory it plausibly sits behind an administrative login, but the description does not state whether a session or credentials are required, and the input vector marks it PR:N - this must be confirmed against the deployment's access controls. Because the product uses a rolling release with no versioning, there is no affected-vs-fixed version boundary, and the vendor did not respond, so no official patched build is identified; updating to the latest commit is the only potential remediation path the evidence implies.

This is a CWE-89 SQL injection in the 'spec' parameter of admin/add-new.php in HashenUdara's edoc-doctor-appointment-system. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) yields a moderate score of 5.5, reflecting low confidentiality, integrity, and availability impact rather than full database compromise. A notable signal conflict exists: the vulnerable endpoint lives under the admin/ path, which normally implies an authenticated administrative context, yet the vector asserts PR:N (unauthenticated) and the description does not state whether authentication is required - this should be verified against the application's access controls, because it materially changes real-world risk. There is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation. The reported priority is 'this_month' (not act_now/emergency), and a public PoC reference exists but is not verified as working exploit code. Overall this is a real but moderate-priority issue: the affected product is an obscure open-source hobby project (see prevalence), the impact metrics are uniformly 'low', and the vendor-vs-location authentication question is unresolved, so it is far from a high-urgency, widely-weaponized threat.

A remote attacker sends a crafted request to admin/add-new.php with a malicious value in the 'spec' argument, injecting SQL that the backend executes against the application database. Per the CVSS vector (AV:N/AC:L), the attack is low-complexity and network-reachable; a public PoC reference exists but is not verified as working exploit code, so weaponization effort is unconfirmed. Success would let the attacker read or alter limited database contents, though whether the admin endpoint first requires authentication is not confirmed in the available sources.