Executive brief
Doctor Appointment System is a PHP-based web application for managing medical appointments. A SQL injection vulnerability in the booking functionality allows attackers to manipulate database queries without authentication, potentially leading to unauthorized access to patient data, modification of appointments and records, and system compromise.
Technical details
A SQL injection vulnerability exists in the /patient/booking.php file due to insufficient input validation of the doc_id parameter. The parameter is used directly in SQL queries without prepared statements or proper sanitization, allowing attackers to inject malicious SQL code. The vulnerability is remotely exploitable without authentication or user interaction. Successful exploitation enables attackers to extract sensitive data from the database, modify or delete records, execute administrative operations, and potentially gain system control. No patches are currently known to be available for version 1.0.
Affected products
- code-projects Doctor Appointment System 1.0
Timeline
- 2026-07-18: disclosed: Vulnerability reported on GitHub
- 2026-09-04: advisory: CVE-2026-85402 published