CVE-2026-105469: girishsaraf Online-Appointment-Booking-System AJAX Endpoint get_town.php sql injection
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnerability affects unknown code of the file gettown.php of the component AJAX Endpoint. Executing a manipulation of the argument countryid/townid/cid/didval/cidval can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments of girishsaraf Online-Appointment-Booking-System containing code up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 may be affected. Because the project uses a rolling release model, no affected or fixed version numbers are available.
What does an attacker need to exploit this issue?
The attack can be launched remotely against the get_town.php AJAX endpoint. The vulnerable inputs are countryid, townid, cid, didval, and cidval; the provided data does not identify any authentication or user-interaction requirement.
How urgent is remediation?
A public exploit has been disclosed and may be used. The reported severity is high, with impacts to confidentiality, integrity, and availability.
How can I determine whether my deployment is affected?
Identify whether your deployment includes the get_town.php AJAX endpoint and accepts the listed parameters. Compare your source state with commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5, while recognizing that no fixed release information is provided.