CVE-2026-85402: code-projects Doctor Appointment System booking.php sql injection
A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument docid results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction according to the supplied severity vector. Exploit code is public, which may lower the effort needed to target exposed installations.
Which component should be prioritized for investigation?
Investigate the patient booking endpoint at /patient/booking.php, specifically handling of the doc_id argument. The affected code is otherwise unspecified, so the available data does not identify a narrower code path.
How can I determine whether my deployment may be affected?
Deployments of code-projects Doctor Appointment System version 1.0 should be treated as potentially affected if they expose the patient booking functionality. Review requests to /patient/booking.php for doc_id values and assess whether that parameter reaches SQL queries without safe parameterization.