Online-Appointment-Booking-System EUVD-2026-98746

Exploitation requires that a running instance of the Online-Appointment-Booking-System be network-reachable and that the changebookingstatus.php endpoint accept attacker-supplied input for the 'dateselected' argument; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no special configuration, and no user interaction are needed against a default deployment. The principal limiting factor is not a configuration prerequisite but exposure itself - the product is a niche open-source project with minimal production deployment, and because it uses a rolling-release model there is no fixed version to pin, so defenders must patch from the latest source rather than a release tag.

Multiple signals converge on this being a genuine but low-tier remote risk rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated SQL injection, which normally warrants urgency; however, the impact metrics are all Low (VC:L/VI:L/VA:L) and the base score is only 6.9 (Medium), reflecting limited data exposure/integrity/availability rather than full database compromise. The 'E:P' (Proof-of-Concept) exploit-maturity value aligns with the reported publicly available exploit, but there is NO CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation - exploitation status is 'publicly available exploit code exists', which must not be conflated with in-the-wild use. The decisive mitigating factor is prevalence: this is an individual developer's GitHub project (girishsaraf/Online-Appointment-Booking-System), not enterprise software, so real-world attack surface is minimal. Net: a real, confirmed-reproducible unauthenticated SQLi worth patching for anyone running this code, but a low operational priority given the tiny deployment footprint and absence of KEV/EPSS escalation signals.

A remote, unauthenticated attacker sends a crafted HTTP request to changebookingstatus.php with a malicious value in the 'dateselected' parameter, injecting SQL that the application concatenates into a query. A public proof-of-concept exists (referenced via the project's GitHub issue tracker), lowering the barrier to reproduction, allowing the attacker to read or tamper with booking data. Because CVSS complexity is Low and no privileges or user interaction are required, the request can be issued directly against an exposed instance.