SQL Injection Vulnerabilities in Online Appointment Booking System

• •Critical SQL injection vulnerabilities allow unauthorized access to patient and admin accounts.
• •Attackers can manipulate login requests to create valid sessions without valid credentials.
• •Immediate evaluation and patching are necessary to mitigate risks associated with these vulnerabilities.

Two SQL injection vulnerabilities have been identified in the Online Appointment Booking System, affecting both patient and admin login endpoints. Attackers can exploit these vulnerabilities to bypass authentication and gain unauthorized access to patient, manager, or doctor sessions. The vulnerabilities arise from the direct concatenation of user credentials into SQL queries without proper escaping or prepared statements. This allows unauthenticated attackers to manipulate login requests and create sessions, enabling them to access sensitive patient information and manage appointments. The vulnerabilities are detailed in issues #5 and #6 on GitHub, published on October 6, 2026. Security professionals are urged to evaluate and patch these vulnerabilities immediately to prevent potential exploitation.