CVE-2026-105387: girishsaraf Online-Appointment-Booking-System SQL injection in patient login

CVE-2026-105387 · Severity: high · CVSS 7.3 · Published 2026-10-05

Online-Appointment-Booking-System is a web application for managing clinic appointments. An unauthenticated attacker can bypass patient login authentication using SQL injection in the username field, gaining access to view, book, and cancel appointments for other patients. The vulnerability allows remote exploitation without any user interaction or prior authentication.

Technologies: Girishsaraf Online-Appointment-Booking-System. Vendors: Girishsaraf.

Quick answers

Is CVE-2026-105387 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-105387 being exploited in the wild.
How severe is CVE-2026-105387?
High severity, with a CVSS score of 7.3, published 5 October 2026.
Which products and versions are affected?
Girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5.
Is there a fix for CVE-2026-105387?
No fixed version is recorded yet. Use prepared statements or parameterized queries instead of string concatenation for all database operations. Implement input validation and use parameterized mysqli queries with bound parameters for the username and password fields.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-105387 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-105387?
Check whether you run Girishsaraf Online-Appointment-Booking-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Use prepared statements or parameterized queries instead of string concatenation for all database operations. Implement input validation and use parameterized mysqli queries with bound parameters for the username and password fields.</anigation> </invoke>

Technical details

SQL injection vulnerability in cover.php's patient login handler (mysqli_query) where username and password parameters are concatenated directly into SQL queries without prepared statements or escaping. An attacker can inject a boolean-based SQL payload such as `' OR '1'='1` to bypass authentication and create an authenticated session. The vulnerability enables authentication bypass and potential database exfiltration.

Affected products

  • girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5

Timeline

  • 2026-09-15: disclosed: Vulnerability reported via GitHub issue
  • 2026-10-05: advisory: CVE-2026-105387 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.