CVE-2026-105471: girishsaraf Online-Appointment-Booking-System Registration signup.php sql injection
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker can exploit it without privileges or user interaction. The vulnerable input is the fname argument handled by signup.php during registration.
Are fixed versions available?
Version-specific affected and updated release information is unavailable because the project uses a rolling-release delivery model. The project was notified through an issue report but had not responded at the time of publication.
How urgent is mitigation?
Public exploit information has been released and may be used in attacks. The reported impact includes confidentiality, integrity, and availability effects.