CVE-2026-109522 Details
Description
A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
A SQL injection vulnerability has been identified in the Online Appointment Booking System by Girish Saraf, affecting versions up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The issue resides in an unknown function within the file Admin/deleteclinic.php, part of the Admin CRUD Endpoint component. The vulnerability arises from the manipulation of the POST parameters 'cid' and 'did', allowing for unauthorized SQL execution. This exploitation can lead to arbitrary SQL commands being executed, including the deletion of database records. The vulnerability is remotely exploitable and has been publicly disclosed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/girishsaraf/Online-Appointment-Booking-System/ | [email protected] | ProductSource CodeVendor |
| https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/12 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-109522 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/984340 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/417186 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/417186/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| girishsaraf Online-Appointment-Booking-System | f427b4757128ca253d33d0cc4e87bbb9c999a4d5 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |