CVE-2026-85402: SQL Injection in code-projects Doctor Appointment System

The vulnerability CVE-2026-85402 exists in code-projects Doctor Appointment System 1.0 within the /patient/booking.php file. It arises from improper sanitization of the doc_id argument, enabling an attacker to perform SQL injection remotely without authentication or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, and no privileges or user interaction required. Exploit code is publicly available, increasing the risk of exploitation. No vendor advisory or patch information is currently provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing exposure. However, the CVSS vector indicates limited impact on confidentiality, integrity, and availability (low to low impact).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to apply input validation or filtering on the doc_id parameter to prevent SQL injection. Monitor for updates from the vendor regarding official patches or mitigations.