CVE-2026-109522: SQL Injection in girishsaraf Online-Appointment-Booking-System

The girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 contains a SQL injection vulnerability in an unknown function within Admin/deleteclinic.php. The vulnerability is triggered by manipulation of the cid or did arguments, enabling remote attackers to execute arbitrary SQL commands. The product follows a rolling release approach, and no specific version information or patch details have been provided by the vendor. The vulnerability was reported early to the project, but no response or remediation has been issued. The CVSS 4.0 base score is 6.9, indicating medium severity.

Successful exploitation of this vulnerability allows remote attackers to perform SQL injection attacks via the cid or did parameters in the Admin/deleteclinic.php endpoint. This can lead to unauthorized data access or modification within the backend database. The vulnerability is remotely exploitable without authentication and requires low attack complexity. However, the impact is limited by low confidentiality, integrity, and availability impacts as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing input validation or parameterized queries on the cid and did parameters as a temporary mitigation. Monitor for updates from the vendor for an official fix.