CVE-2026-105387 in Online-Appointment-Booking-System
Summary
by MITRE • 10/05/2026
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the file cover.php of the component Patient Login Handler. The manipulation of the argument uname/psw results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/05/2026
The Online-Appointment-Booking-System developed by girishsaraf contains a critical security vulnerability within its Patient Login Handler component that allows for remote SQL injection attacks. This flaw is located specifically in the cover.php file, where it affects the execution of the mysqli_query function. The root cause lies in the improper handling and validation of user-supplied input arguments, namely uname and psw, which are typically used to authenticate patient accounts against a backend database. Because these parameters are directly interpolated into SQL queries without adequate sanitization or parameterized query usage, an attacker can inject malicious SQL code that alters the intended logic of the database operation. This type of vulnerability is classically categorized under CWE-89, known as Improper Neutralization of Special Elements used in an SQL Command, which represents one of the most prevalent and dangerous web application security risks identified by industry standards.
The operational impact of this vulnerability is severe due to its remote exploitability. An attacker does not need physical access or prior authentication within a specific role to initiate the attack; instead, they can interact with the login interface from any location over the network. By manipulating the uname and psw fields during the authentication process, an adversary can bypass login restrictions entirely, potentially gaining unauthorized administrative privileges or accessing sensitive patient data stored in the database. This aligns with MITRE ATT&CK technique T1078, which covers Valid Accounts, as well as techniques related to SQL injection such as T1190 if the attack leads to initial access through web application exploits. The ability to execute arbitrary commands on the underlying database server can lead to data exfiltration, modification of critical records, or even complete compromise of the backend infrastructure depending on the privileges granted to the database user account running the application.
The context of this vulnerability is further complicated by the development model employed for the Online-Appointment-Booking-System. The project utilizes a rolling release strategy aimed at providing continuous delivery of features and updates rather than maintaining discrete version numbers with specific patch dates. Consequently, identifying exactly which commits or builds are affected versus those that have been remediated is difficult without direct code analysis against the provided commit hash f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This lack of clear versioning hinders automated vulnerability management and patch deployment processes for organizations relying on this software, as they cannot easily determine if their current instance includes the fix or remains vulnerable to exploitation.
Despite being informed early through an issue report regarding this critical flaw, the project maintainers have not yet responded with a public acknowledgment or a patched release. This delay leaves users exposed to active threats, especially since exploit code has already been released to the public. The availability of proof-of-concept exploits significantly lowers the barrier for entry-level attackers who may lack deep technical expertise in SQL injection but can leverage existing tools to compromise vulnerable instances. Until an official patch is provided and distributed through the rolling release channel, organizations using this system must treat it as compromised or high-risk.
Mitigation strategies should focus on immediate defensive measures since a code fix is not yet available from the vendor. Administrators should implement Web Application Firewalls configured with rulesets capable of detecting and blocking SQL injection patterns in login fields. Additionally, input validation should be enforced at the application layer to reject any special characters or SQL syntax within the uname and psw parameters before they reach the database engine. If possible, restricting access to the cover.php endpoint via IP whitelisting can reduce the attack surface by limiting exposure to trusted networks only. Long-term resolution requires monitoring for official updates from the project maintainers and considering migration to alternative appointment booking systems that adhere to secure coding practices such as prepared statements with parameterized queries to prevent SQL injection entirely.