CVE-2026-105387: girishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli_query sql injection
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file cover.php of the component Patient Login Handler. The manipulation of the argument uname/psw results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction. An attacker manipulates the uname or psw arguments handled by cover.php in the Patient Login Handler.
How likely is active exploitation?
A public exploit has been released and may be used in attacks. The issue is rated high severity, with low attack complexity in the supplied vector.
Which deployments should be treated as affected?
Deployments of girishsaraf Online-Appointment-Booking-System at or before commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 should be treated as affected. Because the project uses rolling releases, no affected or fixed release version is available.
Is a vendor fix available?
The available information does not identify an updated release or patch. The project was notified through an issue report but had not responded at the time of publication.