Online Appointment Booking System
Monthly
Remote unauthenticated attackers can alter other users' appointment booking statuses in girishsaraf's Online-Appointment-Booking-System because the changebookingstatus.php submit2 handler lacks authorization checks (CWE-862). Publicly available exploit code exists, but the issue is assessed as moderate-risk and limited-impact - affecting only booking data - with the product's negligible deployment footprint constraining real-world exposure. No vendor patch has been released, and the project has not responded to the reported issue.
Missing authorization in the Admin/showdoctor.php admin display page of girishsaraf's Online-Appointment-Booking-System allows an unauthenticated remote attacker to directly invoke the endpoint and read administrative doctor-listing data (CWE-862). The project is a rolling-release PHP codebase with no pinned version, so exposure depends entirely on whether an organization has deployed this specific repository; the maintainer was notified through a GitHub issue but has not responded and no vendor patch exists. Publicly available exploit code exists, exploitation requires only network reachability of the affected page, and impact is confined to unauthorized read of admin data with no write or availability effect (per our assessment, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); no confirmed active exploitation (CISA KEV) has been reported.
SQL injection in the Admin/getclinic.php AJAX endpoint of girishsaraf's Online-Appointment-Booking-System lets remote attackers inject arbitrary SQL through the unsanitized city and cid parameters, allowing unauthorized read of database contents and limited data modification. The project uses a rolling release with no tagged versions, so every deployment up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 is presumed affected, and publicly available exploit code exists (no public exploit identified as actively exploited; not listed in CISA KEV). VulDB rates it CVSS 4.0 6.9 with PR:N, while our assessment scores it CVSS 3.1 PR:L and flags that authentication on the Admin/ path must be verified in the deployed instance, since that is the decisive limiter on real-world impact; the vendor was notified via issue #13 and has not responded.
SQL injection in the Admin/deleteclinic.php endpoint of girishsaraf's Appointment Booking System allows remote attackers to manipulate the cid and did parameters and alter backend SQL queries, with low confidentiality, integrity, and availability impact per the supplied CVSS 4.0 score of 6.9. Because the project uses a rolling release, no versioned affected or fixed release is published, and publicly available exploit code exists; no CISA KEV status is provided to confirm active exploitation. The supplied CVSS 4.0 vector marks PR:N (unauthenticated), but the authoritative independent assessment uses PR:L (authenticated) because the vulnerable script is in the Admin area and may require an admin session if access controls are enforced.
Unauthenticated SQL injection in the girishsaraf Online-Appointment-Booking-System allows remote attackers to manipulate the 'dateselected' argument of changebookingstatus.php and thereby alter backend database queries, with the assessed impact limited to low confidentiality, integrity and availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists - the vulnerability is documented in public issue report and VulDB entries - but there is no confirmation of active exploitation (no CISA KEV listing was provided). Because the project follows a rolling-release model, no version-tagged release can be pinned as affected or fixed: the observable snapshot is up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5, the maintainer was informed via GitHub issue #11, and no response or fix has been published. Multiple signals converge on this being a genuine but low-tier remote risk rather than an emergency, since the product is a niche open-source project with minimal production deployment and exposure - not a configuration prerequisite - is the principal limiting factor.
SQL injection in girishsaraf's Online Appointment Booking System allows an authenticated low-privilege user to inject arbitrary SQL through the Doctor and appointment parameters handled by book.php, exposing or corrupting booking-related data. All commits up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5 are affected because the project ships as an unversioned rolling release, and the maintainer has not responded to the vendor notification, so no fixed release exists. Exploitation is remote and publicly available exploit code exists (no CISA KEV listing), but the assessed impact is partial rather than full database takeover, making this a genuine but low-to-moderate priority issue.
Unauthenticated SQL injection in the signup.php registration handler of girishsaraf Online-Appointment-Booking-System lets remote attackers inject arbitrary SQL through the 'fname' form parameter, potentially reading or altering the application's backend database. The flaw carries a CVSS v4.0 base score of 6.9 (CVSS:3.1 equivalent assessed as 6.9, AV:N/AC:L/PR:N/UI:N with low confidentiality, integrity and availability impact) and publicly available exploit code exists, though there is no evidence of confirmed active exploitation (CISA KEV). No official patch is available: the project ships as a rolling release, version information is unavailable, and the maintainer was notified via GitHub issue #9 but has not responded, so the practical risk is driven mainly by exposure of the niche open-source application rather than by attack complexity.
Unauthenticated SQL injection in the Doctor Search endpoint (locateus.php) of girishsaraf's Online-Appointment-Booking-System lets remote attackers inject arbitrary SQL through the 'doctorname' request argument, potentially reading or altering data reachable by the application's database account. Because the project uses a rolling release model, no fixed version is published and the issue report filed against the upstream repository remains unanswered, so every deployed instance that exposes locateus.php over the network is potentially affected. Publicly available exploit code exists (CVSS 4.0 E:P), though the vulnerability is not confirmed as actively exploited and requires the niche PHP application to be publicly reachable for real-world abuse; the vendor has issued no patch.
SQL injection in the girishsaraf Online-Appointment-Booking-System (rolling release) lets unauthenticated remote attackers manipulate the countryid, townid, cid, didval, or cidval parameters in get_town.php to read or alter database contents with low confidentiality, integrity, and availability impact per the assessed vector. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation. The primary real-world limiting factor is deployment scarcity: this is an obscure single-maintainer PHP project unlikely to be exposed at scale, though any network-reachable default instance exposing the AJAX endpoint appears exploitable.
Unauthenticated SQL injection in the administrative login handler (Admin/mlogin.php) of girishsaraf's Online-Appointment-Booking-System allows remote attackers to manipulate the uname and pass parameters, which are passed unsanitized into mysqli_query. Exploitation requires only network reachability to the admin login endpoint - no credentials, user interaction, or non-default configuration - making it trivially automatable against any exposed instance; the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) is rated 6.9, and publicly available exploit code exists (reported via VulDB). The vendor was notified through a GitHub issue but has not responded, and because the project follows a rolling-release model there is no fixed version to upgrade to, so no vendor-released patch is identified at time of analysis. The project is a rarely deployed open-source PHP application, so real-world exposure is limited to internet- or network-reachable instances.
Unauthenticated SQL injection in the patient login handler of girishsaraf's Online-Appointment-Booking-System lets remote attackers manipulate the uname and psw parameters processed by mysqli_query in cover.php. Publicly available exploit code exists - the flaw was disclosed via a public GitHub issue (issue #5) - and the maintainer has not responded or shipped a fix, so every deployment of the rolling-release project is potentially affected. The assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) confirms no credentials, user interaction, or special configuration are needed; the practical limiting factor is exposure, as this is a niche open-source project with few live instances, so CISA KEV does not list it and the overall risk is low-to-moderate and opportunistic rather than urgent.
SQL injection in code-projects Online Appointment Booking System 1.0 allows high-privilege remote attackers to manipulate the managername parameter in /admin/deletemanager.php, resulting in limited confidentiality and integrity impact. EPSS score of 0.05% and CVSS 2.0 reflect the high privilege requirement (PR:H), which severely constrains real-world exploitability despite public POC availability.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to manipulate the 'clinic' parameter in /admin/deletemanagerclinic.php, leading to unauthorized data access, modification, or deletion. A public exploit is available, though no active exploitation has been confirmed (not in CISA KEV), and EPSS indicates low (0.04%) exploitation probability.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the clinic parameter in /admin/addmanagerclinic.php. The vulnerability has a publicly available proof-of-concept exploit, though EPSS probability is low (0.07%) and it is not listed in CISA KEV, indicating limited active exploitation in the wild.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'clinic' parameter in /admin/deletedoctorclinic.php. Attackers can potentially access, modify, or delete database contents. A public exploit is available, but no evidence of active exploitation has been published.
SQL injection in Online Appointment Booking System 1.0 enables remote attackers to execute arbitrary SQL commands via the Username parameter of the /admin/adddoctor.php endpoint. Public exploit code is available, though no active exploitation has been reported. The vulnerability could allow unauthorized database manipulation, potentially exposing patient data.
We are tasked with synthesizing a JSON analysis for CVE-2025-7752. Let's collect data: - CVE ID: CVE-2025-7752 - Description: A vulnerability was found in code-projects Online Appointment Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/deletedoctor.php. The manipulation of the argument did leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. - CVSS Score: 5.5 (Note: the string says "CVSS Score: 5.5" but the vector is CVSS 4.0, so maybe it's a CVSS 4.0 score? I see vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. So the base score is 5.5 (CVSS 4.0). CVSS 4.0 score 5.5 is medium? The base metric is AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So it's a low impact on all vulnerable system components. So indeed 5.5. - CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). This is generic injection; SQL injection is a subset. - EPSS: 0.07%, percentile 21%. Very low exploitation probability. - POC/Exploit: Publicly available (exploit disclosed to public) - Reported by: cna@vuldb.com - CPE: cpe:2.3:a:anisha:online_appointment_booking_system:1.0:*:*:*:*:*:*:* - Tags: PHP, SQLi, Online Appointment Booking System - References: code-projects.org, github exploit, vuldb entries. - KEV status: Not provided in input. No mention of KEV, so assume not in KEV. I'll state "no public exploit identified at time of analysis" would be wrong because POC is available. But "publicly available exploit code exists" is correct. And no KEV, so not actively exploited per CISA KEV. So exploitation status: "publicly available exploit code exists". Not "confirmed actively exploited". - CVSS vector for 3.1? Not provided, need to assess independently. The given vector is CVSS 4.0. We'll need to output our own assessed CVSS 3.1 vector. From the description: Remote attack, SQL injection in /admin/deletedoctor.php via parameter "did". There's no mention of authentication required, but the file is under /admin/ which might imply authentication is needed to reach that page. The description says "unknown functionality", but most admin pages require admin login. However, the CVSS 4.0 vector says PR:N (no privileges required), meaning unauthenticated. So maybe the page is accessible without auth? The input CVSS 4.0 says PR:N. I should consider that as the assessment from the reporter. I'll craft my own assessed CVSS 3.1: AV:N, AC:L, PR:N, UI:N, S:U, C:L/I:L/A:L? SQL injection could lead to data leakage (confidentiality low), modification (integrity low), maybe availability low if data corruption. The vector they gave VC:L/VI:L/VA:L. So I'll mirror that in 3.1: C:L/I:L/A:L. So CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. But the description says "manipulation of the argument did leads to sql injection". No details on impact, but SQLi could allow reading db, maybe RCE? But low impact seems appropriate. I'll use that. Assessed CVSS 3.1 rationale: "Unprotected admin endpoint, no authentication (PR:N), low impact on all CIA." But I must ensure it's grounded. The CVSS 4.0 says PR:N, so I'll use that. I'll explain: "Remote accessible admin page without authentication, easy to exploit, limited impact on data due to SQL injection." Actually SQL injection often leads to full compromise if database permissions allow. But the vendor gave low impact, so I'll keep low. So assessed CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. CVSS 4.0 assessed vector: The same as given, but they gave base only. I'll output the same vector but since they included environmental/time metrics, I'll just give the base vector I assess, which is consistent with my 3.1. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So that works. Now prevalence: The product is "code-projects Online Appointment Booking System 1.0", likely a small open-source project, not widely deployed. So prevalence "low". Prevalence basis: "niche open-source project with limited adoption". I'll write that. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." But wait: is it truly unauthenticated? The vector PR:N, so yes. I'll state that. However, I should check if the endpoint /admin/deletedoctor.php is directly accessible without login. The description does not explicitly say authentication required. So I'll go with PR:N. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." That is allowed. Attack chain: Recon → Access admin endpoint → Send malicious SQL via 'did' parameter → Trigger SQL injection → Extract/modify data in database. I'll condense into 5 steps: Recon → Send crafted HTTP request to /admin/deletedoctor.php with SQL payload in did → SQL injection executed → Exfiltrate or manipulate database → Impact. I'll write: "Send crafted HTTP request to /admin/deletedoctor.php → Inject SQL via did parameter → Execute SQL injection → Extract or modify sensitive data". That's 4 steps: Access (send request) → Exploit (inject SQL) → Execution (SQL injection) → Impact (extract/modify). Simplify: "Identify target system → Send crafted HTTP GET/POST with malicious 'did' parameter → SQL injection executed → Dump or alter database tables". I'll do 4-step: Access → Exploit → Execution → Impact. So: "Send crafted HTTP request to /admin/deletedoctor.php → Inject SQL payload via did parameter → Execute SQL injection → Exfiltrate sensitive information from database". That's fine. Remediation: No specific patch mentioned. The product appears to be a code-projects project, maybe no official patch. I'll suggest: "No vendor-released patch identified at time of analysis. As a workaround, restrict access to the /admin/ directory via .htaccess or web server configuration to trusted IPs, and consider rewriting the vulnerable SQL query with parameterized statements. If the system is not in production, disable the entire application." More precisely, "No patch available from the vendor; apply input validation and parameterized queries manually." I'll phrase: "No vendor patch available. Mitigations: disable the admin panel or restrict access to /admin/ to trusted IPs via web server configuration. Additionally, manually fix the SQL query in deletedoctor.php to use prepared statements. The system is unsupported; consider replacing it." I need a concise paragraph. Confidence notes: "CVE details from VulDB; exploit publicly available. No CISA KEV listing. Patch status unknown — no official fix from vendor. Remote unauthenticated access confirmed by CVSS 4.0 vector PR:N, but endpoint under /admin may imply authentication is required in some deployments; this is ambiguous." I'll mention that the CVSS says PR:N, but admin URL suggests auth, so there might be inconsistency. I'll state: "VulDB report claims unauthenticated remote access (PR:N), but /admin path suggests admin authentication may be required in some configurations. Vendor advisory missing. Confidence in impact limited due to sparse information." Good. Now product_name: "Online Appointment Booking System" - not too wordy. It's a single product. So "Online Appointment Booking System". I'll put that. Summary: I need a 2-3 sentence synthesis that doesn't copy description. Start with specific impact verb: "SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to manipulate database queries via the 'did' parameter in /admin/deletedoctor.php." Add exploitation status: "A public exploit is available, but exploitation probability is low (EPSS 0.07%)." Add who is affected: "Affected is version 1.0, no patch available." Summarize risk: "While CVSS 4.0 rates it medium, real-world risk is low due to limited deployment footprint and low exploitation probability." Technical context: "The vulnerability is an SQL injection in a PHP-based appointment booking application. The /admin/deletedoctor.php script takes a 'did' parameter and uses it directly in an SQL query without sanitization, allowing injection. CWE-74 indicates improper neutralization of special elements used in a downstream component. CPE shows the vendor is Anisha, product Online Appointment Booking System 1.0. PHP MySQL is the likely technology stack." I'll phrase. Risk assessment: Compare CVSS 4.0 score 5.5 (Medium), EPSS 0.07% (very low), no KEV, POC available, SSVC: exploitation available, automatable (AV:N, AC:L, AT:N), technical impact low (L/L/L). So risk is low despite public exploit. I'll say: "CVSS 4.0 base score 5.5 indicates medium severity with low impact on all CIA. EPSS probability of exploitation is only 0.07%, placing it in the 21st percentile — unlikely to be exploited in the wild. A public proof-of-concept exists, but no active exploitation reported. The product is a niche application, reducing mass exploitation risk. Overall, a low real-world priority." Affected products: "Online Appointment Booking System 1.0 (CPE: cpe:2.3:a:anisha:online_appointment_booking_system:1.0). Vendor site: https://code-projects.org/. No specific patched version exists. Affected file /admin/deletedoctor.php." I'll write a paragraph. Remediation paragraph: "No official patch is available. Isolate the admin interface by restricting access to /admin/ to trusted IP addresses via web server configuration (Apache: Require ip x.x.x.x). Manually edit deletedoctor.php to use parameterized queries with prepared statements. If the application is not essential, disable it entirely. Consider migrating to a maintained alternative." That's a good actionable guidance. Exploit scenario: "An unauthenticated attacker sends a crafted HTTP request to /admin/deletedoctor.php with a SQL payload in the 'did' parameter. Successful injection exfiltrates database contents, potentially exposing user credentials and appointment data. The publicly disclosed proof-of-concept facilitates exploitation." Not too long. Exploitation conditions: I already said above. So "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." But maybe the admin page isn't exposed by default; the description says "attack may be launched remotely", so likely no special conditions. I'll add that if the admin interface is not internet-facing, risk is reduced. However, requirement is to state concrete conditions. I'll phrase: "Requires the /admin/deletedoctor.php endpoint to be exposed and reachable without authentication, which is the default configuration." I'll output that. Attack chain: As above: "Send crafted HTTP request to /admin/deletedoctor.php with SQL payload in 'did' parameter → SQL injection executes arbitrary SQL commands → Retrieve, modify, or delete data from the application database." Good. Confidence notes: I need to state confirmed/unknown. "Public exploit confirmed via GitHub. Vendor patch status unknown. Authentication requirements ambiguous—CVSS vector indicates unauthenticated (PR:N) but typical admin pages require login; this discrepancy is noted from NVD/exploit source. No official advisory from vendor exists." That covers it. Prevalence: "low" — niche product. basis: "small open-source project with minimal production use." Assessed CVSS 4.0 vector: I gave earlier, so
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to manipulate database queries via the cid parameter in /admin/addclinic.php. Public exploit code exists, but exploitation probability is low (EPSS 0.07%) and no active exploitation has been confirmed.
SQL injection in Online Appointment Booking System 1.0 allows remote attackers to manipulate the clinic parameter in /admin/adddoctorclinic.php, potentially extracting or modifying database data. The vulnerability has a publicly available exploit but no KEV listing, and EPSS suggests low exploitation probability.
SQL injection in the admin panel of Appointment Booking System 1.0 allows remote unauthenticated attackers to inject malicious SQL via the city parameter in /admin/getmanagerregion.php. Exploit code is publicly available, but no active exploitation is confirmed; EPSS predicts low exploitation probability (0.07%).
CVE-2025-7587 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /cover.php endpoint where uname and psw parameters are not properly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data exfiltration, authentication bypass, and database manipulation. The vulnerability has been publicly disclosed with working exploits available, making active exploitation highly probable in the wild.
CVE-2025-7541 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /get_town.php endpoint where the 'countryid' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the appointment booking system database. The vulnerability has been publicly disclosed with proof-of-concept code available, significantly increasing real-world exploitation risk.
CVE-2025-7540 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System 1.0 affecting the /getclinic.php file's townid parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the database. The vulnerability has been publicly disclosed with exploit code available, creating immediate operational risk for deployed instances.
CVE-2025-7539 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /getdoctordaybooking.php file via the 'cid' parameter. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. Exploitation has been publicly disclosed with proof-of-concept availability, and the vulnerability may be actively exploited in the wild.
CVE-2025-7517 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /getDay.php file's cidval parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, and exploitation requires no special privileges or user interaction, making it an immediate threat to deployed instances.
CVE-2025-7516 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /cancelbookingpatient.php endpoint via the 'appointment' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of appointment records and sensitive patient information. Public disclosure and proof-of-concept availability indicate active exploitation risk.
CVE-2025-7515 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /ulocateus.php file where the 'doctorname' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing real-world exploitation risk.
Remote unauthenticated attackers can alter other users' appointment booking statuses in girishsaraf's Online-Appointment-Booking-System because the changebookingstatus.php submit2 handler lacks authorization checks (CWE-862). Publicly available exploit code exists, but the issue is assessed as moderate-risk and limited-impact - affecting only booking data - with the product's negligible deployment footprint constraining real-world exposure. No vendor patch has been released, and the project has not responded to the reported issue.
Missing authorization in the Admin/showdoctor.php admin display page of girishsaraf's Online-Appointment-Booking-System allows an unauthenticated remote attacker to directly invoke the endpoint and read administrative doctor-listing data (CWE-862). The project is a rolling-release PHP codebase with no pinned version, so exposure depends entirely on whether an organization has deployed this specific repository; the maintainer was notified through a GitHub issue but has not responded and no vendor patch exists. Publicly available exploit code exists, exploitation requires only network reachability of the affected page, and impact is confined to unauthorized read of admin data with no write or availability effect (per our assessment, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); no confirmed active exploitation (CISA KEV) has been reported.
SQL injection in the Admin/getclinic.php AJAX endpoint of girishsaraf's Online-Appointment-Booking-System lets remote attackers inject arbitrary SQL through the unsanitized city and cid parameters, allowing unauthorized read of database contents and limited data modification. The project uses a rolling release with no tagged versions, so every deployment up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 is presumed affected, and publicly available exploit code exists (no public exploit identified as actively exploited; not listed in CISA KEV). VulDB rates it CVSS 4.0 6.9 with PR:N, while our assessment scores it CVSS 3.1 PR:L and flags that authentication on the Admin/ path must be verified in the deployed instance, since that is the decisive limiter on real-world impact; the vendor was notified via issue #13 and has not responded.
SQL injection in the Admin/deleteclinic.php endpoint of girishsaraf's Appointment Booking System allows remote attackers to manipulate the cid and did parameters and alter backend SQL queries, with low confidentiality, integrity, and availability impact per the supplied CVSS 4.0 score of 6.9. Because the project uses a rolling release, no versioned affected or fixed release is published, and publicly available exploit code exists; no CISA KEV status is provided to confirm active exploitation. The supplied CVSS 4.0 vector marks PR:N (unauthenticated), but the authoritative independent assessment uses PR:L (authenticated) because the vulnerable script is in the Admin area and may require an admin session if access controls are enforced.
Unauthenticated SQL injection in the girishsaraf Online-Appointment-Booking-System allows remote attackers to manipulate the 'dateselected' argument of changebookingstatus.php and thereby alter backend database queries, with the assessed impact limited to low confidentiality, integrity and availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists - the vulnerability is documented in public issue report and VulDB entries - but there is no confirmation of active exploitation (no CISA KEV listing was provided). Because the project follows a rolling-release model, no version-tagged release can be pinned as affected or fixed: the observable snapshot is up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5, the maintainer was informed via GitHub issue #11, and no response or fix has been published. Multiple signals converge on this being a genuine but low-tier remote risk rather than an emergency, since the product is a niche open-source project with minimal production deployment and exposure - not a configuration prerequisite - is the principal limiting factor.
SQL injection in girishsaraf's Online Appointment Booking System allows an authenticated low-privilege user to inject arbitrary SQL through the Doctor and appointment parameters handled by book.php, exposing or corrupting booking-related data. All commits up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5 are affected because the project ships as an unversioned rolling release, and the maintainer has not responded to the vendor notification, so no fixed release exists. Exploitation is remote and publicly available exploit code exists (no CISA KEV listing), but the assessed impact is partial rather than full database takeover, making this a genuine but low-to-moderate priority issue.
Unauthenticated SQL injection in the signup.php registration handler of girishsaraf Online-Appointment-Booking-System lets remote attackers inject arbitrary SQL through the 'fname' form parameter, potentially reading or altering the application's backend database. The flaw carries a CVSS v4.0 base score of 6.9 (CVSS:3.1 equivalent assessed as 6.9, AV:N/AC:L/PR:N/UI:N with low confidentiality, integrity and availability impact) and publicly available exploit code exists, though there is no evidence of confirmed active exploitation (CISA KEV). No official patch is available: the project ships as a rolling release, version information is unavailable, and the maintainer was notified via GitHub issue #9 but has not responded, so the practical risk is driven mainly by exposure of the niche open-source application rather than by attack complexity.
Unauthenticated SQL injection in the Doctor Search endpoint (locateus.php) of girishsaraf's Online-Appointment-Booking-System lets remote attackers inject arbitrary SQL through the 'doctorname' request argument, potentially reading or altering data reachable by the application's database account. Because the project uses a rolling release model, no fixed version is published and the issue report filed against the upstream repository remains unanswered, so every deployed instance that exposes locateus.php over the network is potentially affected. Publicly available exploit code exists (CVSS 4.0 E:P), though the vulnerability is not confirmed as actively exploited and requires the niche PHP application to be publicly reachable for real-world abuse; the vendor has issued no patch.
SQL injection in the girishsaraf Online-Appointment-Booking-System (rolling release) lets unauthenticated remote attackers manipulate the countryid, townid, cid, didval, or cidval parameters in get_town.php to read or alter database contents with low confidentiality, integrity, and availability impact per the assessed vector. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation. The primary real-world limiting factor is deployment scarcity: this is an obscure single-maintainer PHP project unlikely to be exposed at scale, though any network-reachable default instance exposing the AJAX endpoint appears exploitable.
Unauthenticated SQL injection in the administrative login handler (Admin/mlogin.php) of girishsaraf's Online-Appointment-Booking-System allows remote attackers to manipulate the uname and pass parameters, which are passed unsanitized into mysqli_query. Exploitation requires only network reachability to the admin login endpoint - no credentials, user interaction, or non-default configuration - making it trivially automatable against any exposed instance; the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) is rated 6.9, and publicly available exploit code exists (reported via VulDB). The vendor was notified through a GitHub issue but has not responded, and because the project follows a rolling-release model there is no fixed version to upgrade to, so no vendor-released patch is identified at time of analysis. The project is a rarely deployed open-source PHP application, so real-world exposure is limited to internet- or network-reachable instances.
Unauthenticated SQL injection in the patient login handler of girishsaraf's Online-Appointment-Booking-System lets remote attackers manipulate the uname and psw parameters processed by mysqli_query in cover.php. Publicly available exploit code exists - the flaw was disclosed via a public GitHub issue (issue #5) - and the maintainer has not responded or shipped a fix, so every deployment of the rolling-release project is potentially affected. The assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) confirms no credentials, user interaction, or special configuration are needed; the practical limiting factor is exposure, as this is a niche open-source project with few live instances, so CISA KEV does not list it and the overall risk is low-to-moderate and opportunistic rather than urgent.
SQL injection in code-projects Online Appointment Booking System 1.0 allows high-privilege remote attackers to manipulate the managername parameter in /admin/deletemanager.php, resulting in limited confidentiality and integrity impact. EPSS score of 0.05% and CVSS 2.0 reflect the high privilege requirement (PR:H), which severely constrains real-world exploitability despite public POC availability.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to manipulate the 'clinic' parameter in /admin/deletemanagerclinic.php, leading to unauthorized data access, modification, or deletion. A public exploit is available, though no active exploitation has been confirmed (not in CISA KEV), and EPSS indicates low (0.04%) exploitation probability.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the clinic parameter in /admin/addmanagerclinic.php. The vulnerability has a publicly available proof-of-concept exploit, though EPSS probability is low (0.07%) and it is not listed in CISA KEV, indicating limited active exploitation in the wild.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'clinic' parameter in /admin/deletedoctorclinic.php. Attackers can potentially access, modify, or delete database contents. A public exploit is available, but no evidence of active exploitation has been published.
SQL injection in Online Appointment Booking System 1.0 enables remote attackers to execute arbitrary SQL commands via the Username parameter of the /admin/adddoctor.php endpoint. Public exploit code is available, though no active exploitation has been reported. The vulnerability could allow unauthorized database manipulation, potentially exposing patient data.
We are tasked with synthesizing a JSON analysis for CVE-2025-7752. Let's collect data: - CVE ID: CVE-2025-7752 - Description: A vulnerability was found in code-projects Online Appointment Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/deletedoctor.php. The manipulation of the argument did leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. - CVSS Score: 5.5 (Note: the string says "CVSS Score: 5.5" but the vector is CVSS 4.0, so maybe it's a CVSS 4.0 score? I see vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. So the base score is 5.5 (CVSS 4.0). CVSS 4.0 score 5.5 is medium? The base metric is AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So it's a low impact on all vulnerable system components. So indeed 5.5. - CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). This is generic injection; SQL injection is a subset. - EPSS: 0.07%, percentile 21%. Very low exploitation probability. - POC/Exploit: Publicly available (exploit disclosed to public) - Reported by: cna@vuldb.com - CPE: cpe:2.3:a:anisha:online_appointment_booking_system:1.0:*:*:*:*:*:*:* - Tags: PHP, SQLi, Online Appointment Booking System - References: code-projects.org, github exploit, vuldb entries. - KEV status: Not provided in input. No mention of KEV, so assume not in KEV. I'll state "no public exploit identified at time of analysis" would be wrong because POC is available. But "publicly available exploit code exists" is correct. And no KEV, so not actively exploited per CISA KEV. So exploitation status: "publicly available exploit code exists". Not "confirmed actively exploited". - CVSS vector for 3.1? Not provided, need to assess independently. The given vector is CVSS 4.0. We'll need to output our own assessed CVSS 3.1 vector. From the description: Remote attack, SQL injection in /admin/deletedoctor.php via parameter "did". There's no mention of authentication required, but the file is under /admin/ which might imply authentication is needed to reach that page. The description says "unknown functionality", but most admin pages require admin login. However, the CVSS 4.0 vector says PR:N (no privileges required), meaning unauthenticated. So maybe the page is accessible without auth? The input CVSS 4.0 says PR:N. I should consider that as the assessment from the reporter. I'll craft my own assessed CVSS 3.1: AV:N, AC:L, PR:N, UI:N, S:U, C:L/I:L/A:L? SQL injection could lead to data leakage (confidentiality low), modification (integrity low), maybe availability low if data corruption. The vector they gave VC:L/VI:L/VA:L. So I'll mirror that in 3.1: C:L/I:L/A:L. So CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. But the description says "manipulation of the argument did leads to sql injection". No details on impact, but SQLi could allow reading db, maybe RCE? But low impact seems appropriate. I'll use that. Assessed CVSS 3.1 rationale: "Unprotected admin endpoint, no authentication (PR:N), low impact on all CIA." But I must ensure it's grounded. The CVSS 4.0 says PR:N, so I'll use that. I'll explain: "Remote accessible admin page without authentication, easy to exploit, limited impact on data due to SQL injection." Actually SQL injection often leads to full compromise if database permissions allow. But the vendor gave low impact, so I'll keep low. So assessed CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. CVSS 4.0 assessed vector: The same as given, but they gave base only. I'll output the same vector but since they included environmental/time metrics, I'll just give the base vector I assess, which is consistent with my 3.1. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So that works. Now prevalence: The product is "code-projects Online Appointment Booking System 1.0", likely a small open-source project, not widely deployed. So prevalence "low". Prevalence basis: "niche open-source project with limited adoption". I'll write that. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." But wait: is it truly unauthenticated? The vector PR:N, so yes. I'll state that. However, I should check if the endpoint /admin/deletedoctor.php is directly accessible without login. The description does not explicitly say authentication required. So I'll go with PR:N. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." That is allowed. Attack chain: Recon → Access admin endpoint → Send malicious SQL via 'did' parameter → Trigger SQL injection → Extract/modify data in database. I'll condense into 5 steps: Recon → Send crafted HTTP request to /admin/deletedoctor.php with SQL payload in did → SQL injection executed → Exfiltrate or manipulate database → Impact. I'll write: "Send crafted HTTP request to /admin/deletedoctor.php → Inject SQL via did parameter → Execute SQL injection → Extract or modify sensitive data". That's 4 steps: Access (send request) → Exploit (inject SQL) → Execution (SQL injection) → Impact (extract/modify). Simplify: "Identify target system → Send crafted HTTP GET/POST with malicious 'did' parameter → SQL injection executed → Dump or alter database tables". I'll do 4-step: Access → Exploit → Execution → Impact. So: "Send crafted HTTP request to /admin/deletedoctor.php → Inject SQL payload via did parameter → Execute SQL injection → Exfiltrate sensitive information from database". That's fine. Remediation: No specific patch mentioned. The product appears to be a code-projects project, maybe no official patch. I'll suggest: "No vendor-released patch identified at time of analysis. As a workaround, restrict access to the /admin/ directory via .htaccess or web server configuration to trusted IPs, and consider rewriting the vulnerable SQL query with parameterized statements. If the system is not in production, disable the entire application." More precisely, "No patch available from the vendor; apply input validation and parameterized queries manually." I'll phrase: "No vendor patch available. Mitigations: disable the admin panel or restrict access to /admin/ to trusted IPs via web server configuration. Additionally, manually fix the SQL query in deletedoctor.php to use prepared statements. The system is unsupported; consider replacing it." I need a concise paragraph. Confidence notes: "CVE details from VulDB; exploit publicly available. No CISA KEV listing. Patch status unknown — no official fix from vendor. Remote unauthenticated access confirmed by CVSS 4.0 vector PR:N, but endpoint under /admin may imply authentication is required in some deployments; this is ambiguous." I'll mention that the CVSS says PR:N, but admin URL suggests auth, so there might be inconsistency. I'll state: "VulDB report claims unauthenticated remote access (PR:N), but /admin path suggests admin authentication may be required in some configurations. Vendor advisory missing. Confidence in impact limited due to sparse information." Good. Now product_name: "Online Appointment Booking System" - not too wordy. It's a single product. So "Online Appointment Booking System". I'll put that. Summary: I need a 2-3 sentence synthesis that doesn't copy description. Start with specific impact verb: "SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to manipulate database queries via the 'did' parameter in /admin/deletedoctor.php." Add exploitation status: "A public exploit is available, but exploitation probability is low (EPSS 0.07%)." Add who is affected: "Affected is version 1.0, no patch available." Summarize risk: "While CVSS 4.0 rates it medium, real-world risk is low due to limited deployment footprint and low exploitation probability." Technical context: "The vulnerability is an SQL injection in a PHP-based appointment booking application. The /admin/deletedoctor.php script takes a 'did' parameter and uses it directly in an SQL query without sanitization, allowing injection. CWE-74 indicates improper neutralization of special elements used in a downstream component. CPE shows the vendor is Anisha, product Online Appointment Booking System 1.0. PHP MySQL is the likely technology stack." I'll phrase. Risk assessment: Compare CVSS 4.0 score 5.5 (Medium), EPSS 0.07% (very low), no KEV, POC available, SSVC: exploitation available, automatable (AV:N, AC:L, AT:N), technical impact low (L/L/L). So risk is low despite public exploit. I'll say: "CVSS 4.0 base score 5.5 indicates medium severity with low impact on all CIA. EPSS probability of exploitation is only 0.07%, placing it in the 21st percentile — unlikely to be exploited in the wild. A public proof-of-concept exists, but no active exploitation reported. The product is a niche application, reducing mass exploitation risk. Overall, a low real-world priority." Affected products: "Online Appointment Booking System 1.0 (CPE: cpe:2.3:a:anisha:online_appointment_booking_system:1.0). Vendor site: https://code-projects.org/. No specific patched version exists. Affected file /admin/deletedoctor.php." I'll write a paragraph. Remediation paragraph: "No official patch is available. Isolate the admin interface by restricting access to /admin/ to trusted IP addresses via web server configuration (Apache: Require ip x.x.x.x). Manually edit deletedoctor.php to use parameterized queries with prepared statements. If the application is not essential, disable it entirely. Consider migrating to a maintained alternative." That's a good actionable guidance. Exploit scenario: "An unauthenticated attacker sends a crafted HTTP request to /admin/deletedoctor.php with a SQL payload in the 'did' parameter. Successful injection exfiltrates database contents, potentially exposing user credentials and appointment data. The publicly disclosed proof-of-concept facilitates exploitation." Not too long. Exploitation conditions: I already said above. So "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." But maybe the admin page isn't exposed by default; the description says "attack may be launched remotely", so likely no special conditions. I'll add that if the admin interface is not internet-facing, risk is reduced. However, requirement is to state concrete conditions. I'll phrase: "Requires the /admin/deletedoctor.php endpoint to be exposed and reachable without authentication, which is the default configuration." I'll output that. Attack chain: As above: "Send crafted HTTP request to /admin/deletedoctor.php with SQL payload in 'did' parameter → SQL injection executes arbitrary SQL commands → Retrieve, modify, or delete data from the application database." Good. Confidence notes: I need to state confirmed/unknown. "Public exploit confirmed via GitHub. Vendor patch status unknown. Authentication requirements ambiguous—CVSS vector indicates unauthenticated (PR:N) but typical admin pages require login; this discrepancy is noted from NVD/exploit source. No official advisory from vendor exists." That covers it. Prevalence: "low" — niche product. basis: "small open-source project with minimal production use." Assessed CVSS 4.0 vector: I gave earlier, so
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to manipulate database queries via the cid parameter in /admin/addclinic.php. Public exploit code exists, but exploitation probability is low (EPSS 0.07%) and no active exploitation has been confirmed.
SQL injection in Online Appointment Booking System 1.0 allows remote attackers to manipulate the clinic parameter in /admin/adddoctorclinic.php, potentially extracting or modifying database data. The vulnerability has a publicly available exploit but no KEV listing, and EPSS suggests low exploitation probability.
SQL injection in the admin panel of Appointment Booking System 1.0 allows remote unauthenticated attackers to inject malicious SQL via the city parameter in /admin/getmanagerregion.php. Exploit code is publicly available, but no active exploitation is confirmed; EPSS predicts low exploitation probability (0.07%).
CVE-2025-7587 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /cover.php endpoint where uname and psw parameters are not properly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data exfiltration, authentication bypass, and database manipulation. The vulnerability has been publicly disclosed with working exploits available, making active exploitation highly probable in the wild.
CVE-2025-7541 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /get_town.php endpoint where the 'countryid' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the appointment booking system database. The vulnerability has been publicly disclosed with proof-of-concept code available, significantly increasing real-world exploitation risk.
CVE-2025-7540 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System 1.0 affecting the /getclinic.php file's townid parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the database. The vulnerability has been publicly disclosed with exploit code available, creating immediate operational risk for deployed instances.
CVE-2025-7539 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /getdoctordaybooking.php file via the 'cid' parameter. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. Exploitation has been publicly disclosed with proof-of-concept availability, and the vulnerability may be actively exploited in the wild.
CVE-2025-7517 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /getDay.php file's cidval parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, and exploitation requires no special privileges or user interaction, making it an immediate threat to deployed instances.
CVE-2025-7516 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /cancelbookingpatient.php endpoint via the 'appointment' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of appointment records and sensitive patient information. Public disclosure and proof-of-concept availability indicate active exploitation risk.
CVE-2025-7515 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /ulocateus.php file where the 'doctorname' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing real-world exploitation risk.