CVE-2026-109521: SQL Injection in girishsaraf Online-Appointment-Booking-System
Description
A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0
Score 6.9medium
Affected software
girishsaraf
Online-Appointment-Booking-System
cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 contains a SQL injection vulnerability in an unknown function within changebookingstatus.php. Manipulating the dateselected parameter leads to SQL injection, which can be exploited remotely without authentication. The product's rolling release model prevents precise version identification. The vulnerability was responsibly disclosed but remains unpatched, and public exploit code exists.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary SQL commands via the dateselected parameter, potentially leading to unauthorized data access or modification. The vulnerability does not require privileges or user interaction, increasing its risk. However, the CVSS vector indicates low confidentiality, integrity, and availability impact, suggesting limited but non-negligible damage.
Mitigation Recommendations
No official fix or patch is currently available as the vendor has not responded to the report. Users should monitor the vendor's channels for updates. Until a patch is released, restricting access to the vulnerable endpoint or implementing web application firewall rules to detect and block SQL injection attempts may help mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-12T19:04:14.910Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ace415b2cdf04f656747da7
Added to database: 10/13/2026, 14:34:03 UTC
Last enriched: 10/13/2026, 14:50:20 UTC
Last updated: 10/13/2026, 18:57:33 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.