CVE-2026-109523: SQL Injection in girishsaraf Online-Appointment-Booking-System

The girishsaraf Online-Appointment-Booking-System contains a SQL injection vulnerability in the Admin/getclinic.php AJAX endpoint. Manipulating the city or cid argument allows an attacker to inject SQL commands remotely without authentication. Due to the rolling release model, precise affected or fixed versions are not provided. The vendor has been notified but has not responded or issued a patch. The vulnerability has a CVSS 4.0 score of 6.9, indicating medium severity. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely without authentication. This can lead to unauthorized data access or modification. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, suggesting partial or limited data exposure or modification. No known active exploitation in the wild has been reported yet.

No official fix or patch has been released by the vendor as of now. Since the vendor has not responded to the issue report, users should consider implementing application-level mitigations such as input validation and parameterized queries for the affected AJAX endpoint if possible. Monitor vendor channels for updates and apply patches promptly once available.