Online Appointment Booking System EUVD-2026-92875

No special conditions - remote unauthenticated exploitation against a reachable instance of girishsaraf Online-Appointment-Booking-System, targeting the public registration handler at signup.php by manipulating the 'fname' parameter. The only prerequisite is network access to a deployed instance exposing the signup page; no authentication, no user interaction, and no non-default configuration is required (PR:N/UI:N/AC:L). The practical limiting factor is not exploit difficulty but exposure: the product is a niche open-source application with very few public deployments, and no official patched release is available because the project ships as a rolling release and the maintainer has not responded.

Signals are mixed and point to a genuine-but-contained issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, and CWE-89 SQL injection on a pre-authentication registration endpoint is inherently attractive to attackers. However, impact is rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), yielding a medium base score of 6.9 rather than critical, which suggests either a constrained injection context or limited data exposure in this specific application. Exploit maturity is Proof-of-Concept (E:P) and public exploit code exists, but the issue is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The decisive risk-limiting factor is deployment footprint: this is a small open-source GitHub project, not enterprise software, so real-world exposure is minimal despite the easy exploitability. No EPSS score and no SSVC decision data were supplied; absent those, this is best treated as a low-priority, easily-exploited flaw in an obscure product - patch or decommission if you run it, but it is not an urgent fleet-wide emergency.

A remote, unauthenticated attacker submits the public user-registration form (signup.php) and injects crafted SQL into the 'fname' parameter, which is concatenated unsanitized into a database query. Because public proof-of-concept exploit code already exists, an attacker can copy it to enumerate, read, or alter database contents without credentials. The low attack complexity and absence of required user interaction make opportunistic scanning and automated exploitation straightforward against any exposed instance.