Skip to content
Threat Feed
high advisory

SQL Injection Vulnerability in SourceCodester Simple Doctors Appointment System 1.0 (CVE-2026-5180)

A SQL Injection vulnerability (CVE-2026-5180) exists in SourceCodester Simple Doctors Appointment System 1.0, allowing remote attackers to execute arbitrary SQL commands by manipulating the 'email' parameter in the /admin/ajax.php?action=login2 endpoint.

SourceCodester Simple Doctors Appointment System 1.0 is vulnerable to SQL Injection (CVE-2026-5180). The vulnerability is located in the /admin/ajax.php?action=login2 endpoint, specifically the email parameter. A remote attacker can inject arbitrary SQL commands by manipulating this parameter. The vulnerability has been confirmed and an exploit is publicly available, increasing the risk of widespread exploitation. Successful exploitation can lead to unauthorized data access, modification…

Detection coverage 2

Detect SQL Injection Attempts in Simple Doctors Appointment System

high

Detects potential SQL injection attempts targeting the /admin/ajax.php endpoint in Simple Doctors Appointment System

sigma tactics: initial_access techniques: T1190, T1595.002 sources: webserver, linux

Detect Access to admin/ajax.php

low

Detects access to admin/ajax.php which may indicate malicious activity

sigma tactics: initial_access techniques: T1190 sources: webserver, linux

Detection queries are kept inside the platform. Get full rules →

Indicators of compromise

5

url