CVE-2026-105470: girishsaraf Online-Appointment-Booking-System Doctor Search Endpoint locateus.php mysqli_query sql injection
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqliquery of the file locateus.php of the component Doctor Search Endpoint. The manipulation of the argument doctorname leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerable Doctor Search Endpoint can be exploited remotely without authentication or user interaction. An attacker manipulates the doctorname argument handled by locateus.php.
Are publicly accessible deployments at risk?
Yes. The attack vector is network-based, requires no privileges, and targets the Doctor Search Endpoint, so deployments that expose this endpoint are relevant to triage.
How can we determine whether our deployment is affected?
Check whether the application includes locateus.php with the Doctor Search functionality and passes the doctorname argument to mysqli_query. The issue is reported in revisions up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5; no fixed release details are provided because the project uses rolling releases.
Is exploitation likely to be practical?
A public exploit is available, and the reported attack complexity is low. The vulnerability can affect confidentiality, integrity, and availability.
Is a vendor fix available?
No updated release or fix information is provided. The project was notified through an issue report but had not responded at the time of the report.