CVE-2026-105471
Received Received - Intake

SQL Injection in Online Appointment Booking System

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: VulDB

Description
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-105471
EUVD
EUVD-2026-92875

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
girishsaraf Online-Appointment-Booking-System f427b4757128ca253d33d0cc4e87bbb9c999a4d5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection flaw in the Online Appointment Booking System. It occurs in the signup.php file where user input from the fname parameter is directly used in an SQL INSERT statement without sanitization. Attackers can inject malicious SQL code into this parameter to manipulate database queries.

Detection Guidance

To detect this SQL injection vulnerability, inspect the signup.php file in the Online Appointment Booking System for direct user input concatenation into SQL queries. Check if the fname parameter is used without sanitization. Enable error-based SQL injection by triggering database errors and observing raw SQL query outputs. Test with payloads like ' OR 1=1 -- in the fname field to see if it affects query execution.

Impact Analysis

An attacker can exploit this to extract sensitive data like plaintext passwords from the database without authentication. They can also perform unauthorized data exfiltration and view full SQL queries and error messages, leading to information disclosure.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized data access and potential exposure of sensitive personal information. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. The flaw enables data breaches, risking non-compliance.

Mitigation Strategies

Immediately patch the signup.php file to use prepared statements with parameterized queries instead of direct input concatenation. Disable error display in production to prevent information leakage. Update the system to the latest version if available. Monitor database logs for suspicious queries or unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105471. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart