CVE-2026-105468: girishsaraf Online-Appointment-Booking-System Login mlogin.php mysqli_query sql injection
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file Admin/mlogin.php of the component Login Handler. Performing a manipulation of the argument uname/pass results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of girishsaraf Online-Appointment-Booking-System containing the affected Admin/mlogin.php code are exposed. The issue is reachable remotely through the Login Handler.
What does an attacker need to exploit it?
No authentication or user interaction is required. An attacker can manipulate the uname or pass argument supplied to Admin/mlogin.php to trigger SQL injection through mysqli_query.
How likely is exploitation?
A public exploit is available, and the attack complexity is rated low. This increases the likelihood of remote exploitation against reachable affected installations.
How can I determine whether my deployment is affected?
Review Admin/mlogin.php, specifically the Login Handler's use of mysqli_query with the uname and pass inputs. The affected code is reported through commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5, but specific fixed release versions are not available because the project uses a rolling release model.
What should I do if an update is not available?
No vendor response or fixed release is identified in the available data. Restrict remote access to the affected login handler where possible and prioritize reviewing or replacing the vulnerable SQL query handling for uname and pass inputs.