CVE-2026-105387: SQL Injection in girishsaraf Online-Appointment-Booking-System

This vulnerability in girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 allows remote attackers to perform SQL injection via the uname or psw arguments in the Patient Login Handler's cover.php file. The flaw arises from improper sanitization or validation of these inputs before being passed to mysqli_query. The project employs rolling releases, so no discrete version numbers for affected or patched releases are provided. The vendor has been notified but has not responded or released a patch. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to data leakage, modification, or denial of service. The vulnerability's CVSS 4.0 score is 6.9 (medium), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing temporary mitigations such as input validation, parameterized queries, or web application firewalls to block SQL injection attempts until an official patch is available.