CVE-2026-105468: SQL Injection in girishsaraf Online-Appointment-Booking-System

The girishsaraf Online-Appointment-Booking-System contains a SQL injection vulnerability in the Login Handler's Admin/mlogin.php file. Specifically, the mysqli_query function does not properly sanitize the uname and pass parameters, allowing an attacker to inject SQL commands remotely. The vulnerability is exploitable without privileges or user interaction. Due to the rolling release model of the product, exact affected versions are not specified. The vendor has been notified but has not issued a fix or advisory. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to perform SQL injection attacks against the backend database. This can lead to unauthorized data access, data modification, or other database-related impacts depending on the attacker's payload. The vulnerability affects the login mechanism, potentially enabling bypass or compromise of authentication controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a fix is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the login parameters.