# CVE-2026-105469: girishsaraf Online-Appointment-Booking-System SQL injection in AJAX endpoints

Source: https://junglewise.ai/threats/cve-2026-105469-a-vulnerability-was-determined-in-girishsaraf-online-appointment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105469 · Severity: high · CVSS 7.3 · Published 2026-10-05

An online appointment booking system for retail clinics contains unauthenticated SQL injection vulnerabilities in multiple AJAX endpoints that handle clinic and appointment queries. An attacker can remotely extract sensitive patient data, appointment records, and credentials by injecting SQL commands into POST parameters without needing to log in.

Technologies: [Girishsaraf Online-Appointment-Booking-System](https://junglewise.ai/threats/technologies/online-appointment-booking-system). Vendors: [Girishsaraf](https://junglewise.ai/threats/vendors/girishsaraf).

## Quick answers

**Is CVE-2026-105469 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105469 being exploited in the wild.

**How severe is CVE-2026-105469?** High severity, with a CVSS score of 7.3, published 5 October 2026.

**Which products and versions are affected?** Girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5.

**Is there a fix for CVE-2026-105469?** No fixed version is recorded yet. Use prepared statements with parameterized queries for all database interactions. Implement input validation and sanitization for all POST parameters before use in SQL queries.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105469 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105469?** Check whether you run Girishsaraf Online-Appointment-Booking-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Use prepared statements with parameterized queries for all database interactions. Implement input validation and sanitization for all POST parameters before use in SQL queries.</anigation>
</invoke>

## Technical details

Time-based blind SQL injection exists in get_town.php, getclinic.php, getdoctordaybooking.php, and getDay.php endpoints where POST parameters (countryid, townid, cid, didval, cidval) are concatenated directly into SQL queries without parameterization or input validation. The vulnerable code concatenates user input via $_POST directly into $conn->query() calls. An unauthenticated remote attacker can inject SLEEP() expressions to observe time delays and confirm SQL injection, enabling database exfiltration via tools like sqlmap.

## Affected products

- girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5

## Timeline

- 2026-09-16: disclosed: Issue reported on GitHub by ThanatosXingYu
- 2026-10-05: advisory: Published on NVD as CVE-2026-105469

## References

- [https://github.com/girishsaraf/Online-Appointment-Booking-System/](https://github.com/girishsaraf/Online-Appointment-Booking-System/)
- [https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/7](https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/7)

## Related threats

- [girishsaraf Online-Appointment-Booking-System missing authorization in booking status update](https://junglewise.ai/threats/cve-2026-109525-a-vulnerability-was-identified-in-girishsaraf-online-appointment)
- [girishsaraf Online-Appointment-Booking-System missing authorization in admin pages](https://junglewise.ai/threats/cve-2026-109524-a-vulnerability-was-determined-in-girishsaraf-online-appointment)
- [girishsaraf Online-Appointment-Booking-System SQL injection in AJAX endpoints](https://junglewise.ai/threats/cve-2026-109523-a-vulnerability-was-found-in-girishsaraf-online-appointment)
- [girishsaraf Online-Appointment-Booking-System SQL injection in Admin CRUD](https://junglewise.ai/threats/cve-2026-109522-a-vulnerability-has-been-found-in-girishsaraf-online-appointment)
- [girishsaraf Online-Appointment-Booking-System SQL injection in changebookingstatus.php](https://junglewise.ai/threats/cve-2026-109521-a-vulnerability-was-detected-in-girishsaraf-online-appointment)