# CVE-2026-109521: girishsaraf Online-Appointment-Booking-System SQL injection in changebookingstatus.php

Source: https://junglewise.ai/threats/cve-2026-109521-a-vulnerability-was-detected-in-girishsaraf-online-appointment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109521 · Severity: high · CVSS 7.3 · Published 2026-10-13

An online appointment booking system for clinics contains an unauthenticated SQL injection vulnerability in the changebookingstatus.php file. An attacker can inject malicious SQL code through the dateselected parameter to extract sensitive appointment and patient data from the database. The vulnerability requires no authentication and can be exploited remotely, potentially compromising the confidentiality of all patient and booking information.

Technologies: [Girishsaraf Online-Appointment-Booking-System](https://junglewise.ai/threats/technologies/online-appointment-booking-system). Vendors: [Girishsaraf](https://junglewise.ai/threats/vendors/girishsaraf).

## Quick answers

**Is CVE-2026-109521 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109521 being exploited in the wild.

**How severe is CVE-2026-109521?** High severity, with a CVSS score of 7.3, published 13 October 2026.

**Which products and versions are affected?** Girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5.

**Is there a fix for CVE-2026-109521?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109521 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-109521?** Check whether you run Girishsaraf Online-Appointment-Booking-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The changebookingstatus.php file concatenates user-supplied input from the dateselected POST parameter directly into a SQL query without sanitization, prepared statements, or authentication checks. An unauthenticated attacker can perform blind SQL injection using time-based techniques (e.g., SLEEP() expressions) to infer database contents and extract sensitive data. The vulnerability affects commits up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5, and the project uses a rolling release model without specific patched versions identified.

## Affected products

- girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5

## Timeline

- 2026-09-16: disclosed: Vulnerability reported via GitHub issue #11
- 2026-10-13: advisory: CVE-2026-109521 published

## References

- [https://github.com/girishsaraf/Online-Appointment-Booking-System/](https://github.com/girishsaraf/Online-Appointment-Booking-System/)
- [https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/11](https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/11)

## Related threats

- [girishsaraf Online-Appointment-Booking-System missing authorization in booking status update](https://junglewise.ai/threats/cve-2026-109525-a-vulnerability-was-identified-in-girishsaraf-online-appointment)
- [girishsaraf Online-Appointment-Booking-System missing authorization in admin pages](https://junglewise.ai/threats/cve-2026-109524-a-vulnerability-was-determined-in-girishsaraf-online-appointment)
- [girishsaraf Online-Appointment-Booking-System SQL injection in AJAX endpoints](https://junglewise.ai/threats/cve-2026-109523-a-vulnerability-was-found-in-girishsaraf-online-appointment)
- [girishsaraf Online-Appointment-Booking-System SQL injection in Admin CRUD](https://junglewise.ai/threats/cve-2026-109522-a-vulnerability-has-been-found-in-girishsaraf-online-appointment)
- [girishsaraf Online-Appointment-Booking-System SQL injection in Booking Handler](https://junglewise.ai/threats/cve-2026-105472-a-weakness-has-been-identified-in-girishsaraf-online-appointment)