CVE-2026-105471: SQL Injection in girishsaraf Online-Appointment-Booking-System

This vulnerability involves an SQL injection in the 'fname' parameter of the signup.php file within the Registration Handler component of the girishsaraf Online-Appointment-Booking-System. An attacker can remotely exploit this flaw to manipulate SQL queries, potentially compromising the database. The product follows a rolling release model, making it difficult to specify exact affected versions. Although the issue was reported early, the vendor has not provided a patch or response. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this SQL injection vulnerability can allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, data modification, or other database impacts. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the moderate impact and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor for updates from the vendor. Until a patch is available, consider applying application-layer mitigations such as input validation, parameterized queries, or web application firewalls to reduce risk.