Description

A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-07T19:17:40.840Z",
  "pubdate": "2026-08-07T19:17:40.840Z",
  "executiveSummary": "An SQL injection vulnerability has been identified in SourceCodester Simple Doctors Appointment System 1.0, specifically within the administrative endpoint /admin/ajax.php?action=delete_appointment.\nThe flaw arises due to insufficient sanitization and validation of user-supplied input passed via the ID argument before it is concatenated into database queries.\nSuccessful exploitation of this vulnerability allows remote attackers to manipulate SQL query logic, potentially leading to unauthorized data access, modification, or deletion within the underlying database.\nThe risk implications are severe, as the vulnerability affects core administrative functionalities and can be triggered remotely without complex pre-conditions.\nPublic availability of exploit details significantly increases the likelihood of active exploitation attempts against vulnerable deployments.\nOrganizations utilizing this software are exposed to complete database compromise if remediation steps are not promptly applied.",
  "technicalDetails": "The vulnerability resides in the backend script located at /admin/ajax.php when processing requests with the parameter action=delete_appointment.\nThe root cause of the issue is the insecure handling of the ID argument, where raw, unescaped input is directly incorporated into a database management system query string.\nBecause the application fails to utilize parameterized queries or prepared statements, an attacker can supply specially crafted SQL payloads via the vulnerable ID parameter to alter the intended query structure.\nThe attack flow initiates with a remote attacker sending an HTTP request to the vulnerable endpoint /admin/ajax.php?action=delete_appointment with a malicious SQL injection payload injected into the ID parameter.\nUpon receiving the request, the server-side PHP script evaluates the concatenated query containing the attacker-controlled input, executing arbitrary database commands under the privileges of the database user account configured for the application.\nNetwork exposure for this attack vector is high, as the administrative AJAX endpoint is typically accessible over HTTP/HTTPS interfaces.\nDepending on the configuration and database privileges, post-exploitation impact includes the extraction of sensitive information such as user credentials, appointment records, and administrative session data, or the potential execution of administrative database operations.\nAuthentication and privilege requirements depend on the session context expected by the application, but remote exploitation remains feasible if session validation checks can be bypassed or if the endpoint improperly handles unauthenticated requests."
}