EUVD-2026-70820
GHSA-6j52-mxqw-g89c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify publicly accessible /patient_login.php endpoint
-
DeliveryInject time-based SQL payload into email POST parameter
-
ExploitMeasure response delays to confirm execution
-
ExecutionEnumerate database schema via conditional timing queries
-
ImpactExtract patient credentials and appointment data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required. The /patient_login.php endpoint is publicly accessible to unauthenticated remote attackers in any standard deployment, as it is the patient login page intended to be internet-facing. No specific configuration option needs to be enabled. Exploitation is only constrained by the inherent slowness of time-based blind SQL injection (data extraction is character-by-character via timing), and by the fact that this is an educational/demo product unlikely to be deployed at scale in production environments handling sensitive data. |
| Impact | The CVSS 4.0 score of 6.9 with E:P (proof-of-concept evidence confirmed) represents a moderate-to-elevated practical risk for any deployment of this application. The attack vector is fully remote, requires no authentication, no user interaction, and no special attack conditions (AV:N/AC:L/AT:N/PR:N/UI:N), making the endpoint trivially reachable from the internet. All impact dimensions are rated low (VC:L/VI:L/VA:L), which is consistent with time-based blind injection being slower and more indirect than error-based or UNION-based extraction. The public GitHub POC eliminates the need for attacker expertise, materially raising exploitation likelihood. No CISA KEV listing is present, indicating no confirmed widespread in-the-wild exploitation at time of analysis. The product's educational/demo positioning sharply limits real-world deployment footprint, which is the primary factor keeping aggregate risk contained despite favorable attacker conditions. |
| Exploit ScenarioDerived | An unauthenticated attacker sends crafted HTTP POST requests to /patient_login.php with a time-based payload in the email field (e.g., foo@bar.com' AND SLEEP(5)-- ) and measures response latency to confirm injection. Using a tool such as sqlmap pointed at the injectable parameter, the attacker systematically enumerates table names, column names, and ultimately dumps patient credentials and appointment records from the database. The public GitHub POC by ahmadmarz10-hub documents this exact technique and parameter, enabling near-zero-skill exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Unauthenticated SQL injection in code-projects Doctor Appointment System 1.0 allows remote attackers to enumerate and extract database contents by exploiting the email parameter in the patient login endpoint (/patient_login.php) via time-based blind techniques. A public GitHub proof-of-concept documents the exact method, lowering the exploitation bar to script-kiddie level. No patch has been released by the vendor; the product appears to be an educational PHP demo with limited production presence.
RemediationAI
No vendor-released patch has been identified at time of analysis. The primary fix is to rewrite the SQL query in /patient_login.php using parameterized queries or prepared statements (e.g., PHP PDO or MySQLi with bind_param), which eliminates the injection surface at the root cause. As compensating controls: deploy a WAF rule targeting time-based blind injection patterns (e.g., SLEEP, BENCHMARK, WAITFOR DELAY) against the email parameter specifically; rate-limit and IP-throttle POST requests to the login endpoint to slow automated exploitation; and reduce the database user's privileges to the minimum required (SELECT on patient tables only, no FILE, EXECUTE, or SUPER grants) to limit exfiltration scope. Given this is an educational demo codebase from code-projects.org, it should not be deployed in production without a comprehensive security review. No official fix version exists to cite at this time.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is a PHP-based web application (CPE: cpe:2.3:a:code-projects:doctor_appointment_system:*:*:*:*:*:*:*:*) from code-projects.org, a site that publishes educational source-code projects. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the application constructs SQL queries by directly interpolating the user-supplied email field from the patient login form without parameterized queries or prepared statements. The GitHub POC specifically identifies this as time-based blind SQL injection, meaning the attacker injects conditional timing functions (e.g., MySQL SLEEP()) into the query and infers database contents by measuring differential response latencies - no visible error output is required.
Know when Doctor Appointment System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-accessible public login page, no auth required; time-based blind SQLi yields data extraction (C:L/I:L) but does not cause direct availability disruption (A:N).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient_login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Doctor Appointment System
View allSourcecodester Doctor Appointment System 1.0 is vulnerable to SQL Injection in the variable $userid at doctors\myDetails
Doctormms v1.0 was discovered to contain a SQL injection vulnerability via the $userid parameter at myAppoinment.php. Ra
SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL q
Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malic
Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malic
Blind SQL injection in contactus.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malic
Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malic
A vulnerability classified as critical was found in projectworlds Online Doctor Appointment Booking System 1.0. Rated me
A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. Rated medium severity (CVSS 6.9
SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated
Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to in
Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to in
Exploit-DB