Description

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=set_appointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-10T03:16:40.050Z",
  "pubdate": "2026-08-10T03:16:40.050Z",
  "executiveSummary": "A SQL injection vulnerability has been identified in SourceCodester Simple Doctors Appointment System 1.0, specifically within an unknown function handling requests to the file /admin/ajax.php?action=set_appointment.\nThis security flaw allows remote attackers to manipulate the ID argument, leading to unauthorized execution of malicious SQL queries against the underlying database.\nThe vulnerability poses significant risk implications, including potential data exfiltration, database compromise, and unauthorized administrative access.\nExploitation can be initiated remotely without requiring prior authentication, and a public exploit has already been made available, increasing the likelihood of active exploitation in the wild.\nAffected systems require immediate remediation to prevent complete confidentiality, integrity, and availability breaches of the backend data store.",
  "technicalDetails": "The vulnerability stems from improper neutralization of special elements used in an SQL command within the source code of SourceCodester Simple Doctors Appointment System 1.0.\nThe vulnerable component resides in the backend script located at /admin/ajax.php, specifically when processing requests where the action parameter is set to set_appointment.\nThe root cause of the issue is the direct concatenation or unsafe handling of user-supplied input passed via the ID argument into database query statements without adequate parameterization, sanitization, or input validation.\nAn unauthenticated remote attacker can initiate the attack by sending a maliciously crafted HTTP request targeting the vulnerable endpoint.\nBy injecting specially crafted SQL payloads into the ID parameter, the attacker can alter the abstract syntax tree of the intended SQL query, allowing arbitrary database commands to be executed.\nThe attack flow proceeds as follows: 1) The client transmits an HTTP request containing the malicious SQL payload within the ID parameter to /admin/ajax.php?action=set_appointment. 2) The server-side script receives the input and incorporates it directly into a database query. 3) The database management system parses and executes the modified query, returning unintended data or performing unauthorized database modifications.\nGiven that the application interacts with sensitive medical and user data, post-exploitation impact includes the extraction of confidential records, administrative credential compromise, and potential full system takeover depending on database user privileges."
}