CVE-2026-105472: SQL Injection in girishsaraf Online-Appointment-Booking-System

This vulnerability in girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 allows remote attackers to perform SQL injection via manipulation of the Doctor/appointment argument in the book.php file's Booking Handler component. The injection flaw could enable attackers to interfere with the application's database queries. The product's rolling release model prevents precise version identification. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity) and public exploit code exists. The vendor has not yet issued a fix or official response.

Successful exploitation could allow an attacker with low privileges to inject SQL commands remotely, potentially leading to partial compromise of the database confidentiality, integrity, or availability. The CVSS vector indicates low attack complexity and no user interaction required, but limited scope and impact. Public exploit availability increases the risk of attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, consider applying temporary mitigations such as input validation or web application firewalls to detect and block SQL injection attempts targeting the Doctor/appointment parameter.