SQL Injection Vulnerability in Online-Appointment-Booking-System

The Online-Appointment-Booking-System, developed by girishsaraf, contains a critical SQL injection vulnerability tracked as CVE-2026-109522. The vulnerability resides in the Admin/deleteclinic.php file within the Admin CRUD component. By manipulating the 'cid' or 'did' arguments in HTTP requests, a remote, unauthenticated attacker can inject arbitrary SQL commands into the backend database. This issue affects all versions of the application up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5. As the project follows a continuous delivery model without specific versioning, users are advised to review the source code for the presence of the vulnerable Admin/deleteclinic.php file. Public exploit code for this vulnerability has been disclosed, increasing the risk of exploitation by opportunistic threat actors.

Impact

Successful exploitation of CVE-2026-109522 allows an unauthenticated remote attacker to gain unauthorized access to the application database. This could result in complete data exfiltration of appointment records, clinic data, and potential administrative account compromise. Given the public availability of exploit code, organizations deploying this system are at high risk of immediate compromise if they remain on vulnerable builds.

Recommendation

Prioritized actions for security teams:

• Identify and audit any deployments of the Online-Appointment-Booking-System in your environment.
• Apply security controls at the Web Application Firewall (WAF) layer to inspect and block HTTP requests to Admin/deleteclinic.php containing suspicious SQL syntax in the 'cid' or 'did' parameters.
• Monitor web server access logs for anomalous requests to the deleteclinic.php endpoint, particularly those containing common SQL injection payloads.
• Evaluate the necessity of the Online-Appointment-Booking-System in your infrastructure until a patch is provided by the maintainer.