Doctor Appointment System EUVD-2026-70873

No special conditions are required beyond network reachability of the /patient/booking.php endpoint. The CVSS 4.0 vector confirms PR:N and UI:N, meaning exploitation is unauthenticated and requires no victim interaction. The application must simply be deployed and accessible over HTTP/HTTPS - no non-default configuration, feature flag, or plugin is needed. The doc_id parameter is a standard booking form field (doctor selection), present in normal application usage. The only limiting factors are that the PHP application must be running with database connectivity active, and the server must not be behind a WAF or IP-allowlist that blocks external requests.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 5.5) rates vulnerable-system impact as VC:L/VI:L/VA:L, which appears conservative for a SQL injection vulnerability - full database exfiltration is generally achievable via standard techniques, warranting C:H in an independent assessment. No EPSS score was provided; the presence of a public PoC on GitHub elevates real-world exploitation probability substantially above baseline for this class of vulnerability. No CISA KEV listing exists at time of analysis, but the combination of PR:N/UI:N attack surface and public exploit code makes automated scanning straightforward. Even a mid-sized municipal IT team in swidnica that has deployed this booking system as part of a local healthcare portal should treat this as urgent given the fully unauthenticated, network-accessible attack path. The primary limiting factor on actual harm is the likely narrow deployment footprint - this is a demo-grade project, not a widely distributed commercial platform.

An unauthenticated attacker discovers the internet-facing booking endpoint and sends an HTTP GET or POST request to /patient/booking.php?doc_id=1' OR 1=1 UNION SELECT table_name,2,3 FROM information_schema.tables--. The application passes this unsanitized input directly into a SQL query, returning enumerated table names in the response. The attacker then proceeds to dump the users or patients table, extracting plaintext or weakly hashed credentials and personal health information. Public exploit code on GitHub (https://github.com/lccc-t/CVE/issues/5) provides a ready-made template for this extraction.