Online-Appointment-Booking-System EUVD-2026-92816

Exploitation requires network access to the application's administrative login endpoint Admin/mlogin.php and the ability to submit the uname and/or pass parameters, which are passed into mysqli_query without sanitization - no authentication, user interaction, or non-default configuration is required (PR:N/UI:N). The practical limiting factors are deployment-specific: the target must be an internet- or network-reachable instance of girishsaraf Online-Appointment-Booking-System, a rarely deployed open-source project, and because it is rolling-release there is no vendor patch, so the only mitigations are custom input sanitization/prepared statements or restricting access to the admin interface.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, which is consistent with the description of a login handler flaw manipulable via the uname/pass parameters before authentication - the signals are internally coherent here. However, the base score of 6.9 (Medium) reflects the fact that all impact metrics are only Low (VC:L/VI:L/VA:L), i.e. partial rather than total compromise, which is atypical for a classic authentication-bypass SQLi and may understate real impact if the injection permits full database extraction. EPSS and SSVC data are not provided, and the vector's E:P (Exploit:Proof-of-Concept) plus the GitHub issue reference confirm only that public exploit code exists - this is NOT active exploitation; there is no CISA KEV listing. The dominant risk-lowering factor is prevalence: this is an obscure hobbyist GitHub project with a rolling-release model and an unresponsive maintainer, so despite trivial exploitability this is a low real-world priority rather than a widespread threat. Net assessment: technically easy to exploit and POC-backed, but confined to a tiny deployment footprint, making it a targeted/opportunistic concern rather than a mass-exploitation priority.

A remote, unauthenticated attacker sends a crafted HTTP POST to Admin/mlogin.php with malicious SQL metacharacters in the uname or pass field, causing the unsanitized mysqli_query to execute attacker-controlled SQL. Public proof-of-concept exists (referenced in the project's GitHub issue tracker), so an attacker could bypass admin login or extract/modify database records without prior credentials. Because the login page is network-facing and complexity is low, no special timing or privileges are needed.