CVE-2026-105469: SQL Injection in girishsaraf Online-Appointment-Booking-System

This vulnerability exists in the girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5. It affects the AJAX endpoint implemented in get_town.php, where manipulation of the arguments countryid, townid, cid, didval, or cidval can lead to SQL injection. The attack can be launched remotely without authentication. The project was notified early but has not issued a response or patch. The product uses a rolling release model, so no explicit versioning is available for affected or fixed releases. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.

Successful exploitation of this vulnerability allows remote attackers to perform SQL injection attacks against the backend database via the specified parameters. This can lead to unauthorized data access or modification. The vulnerability does not require authentication or user interaction. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor for updates from the project. Until a patch is available, consider applying input validation or web application firewall rules to block malicious SQL injection payloads targeting the affected parameters.