CVE-2026-19384: Doctors Appointment System SQL Injection

CVE-2026-19384 Overview

CVE-2026-19384 is a SQL injection vulnerability in SourceCodester Simple Doctors Appointment System 1.0. The flaw affects the /admin/ajax.php?action=set_appointment endpoint, where the ID argument is passed directly into a database query without proper sanitization. Remote attackers can exploit the flaw over the network without authentication or user interaction. Public exploit details have been published, increasing the likelihood of opportunistic scanning and exploitation attempts.

Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL statements through the ID parameter, exposing appointment records, patient data, and administrative account information stored in the backend database.

Affected Products

SourceCodester Simple Doctors Appointment System 1.0
The vulnerable component: /admin/ajax.php with action=set_appointment
Deployments using the shipped administrative AJAX handler

Discovery Timeline

2026-08-10 - CVE-2026-19384 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19384

Vulnerability Analysis

The vulnerability resides in the administrative AJAX handler /admin/ajax.php when invoked with action=set_appointment. The ID parameter supplied in the request is concatenated into an SQL statement without parameterization or input validation. This allows attackers to break out of the intended query context and append arbitrary SQL clauses.

Because the endpoint is reachable remotely and requires no authentication or user interaction, exploitation is straightforward. The Common Weakness Enumeration classifies this as [CWE-74] improper neutralization of special elements in output used by a downstream component. Successful injection can leak data from the appointment database, tamper with records, and pivot toward authentication bypass through credential extraction from the admin table.

Root Cause

The root cause is direct string concatenation of user-controlled input into an SQL query. The PHP handler does not use prepared statements or parameter binding, nor does it enforce type coercion on the ID argument before it reaches the database layer.

Attack Vector

An attacker submits a crafted HTTP request to /admin/ajax.php?action=set_appointment with a malicious ID value. Payloads can include UNION-based, boolean-based, or time-based blind SQL injection techniques to enumerate schema, extract row data, or infer database contents. No credentials, session cookies, or user interaction are required.

Detailed reproduction notes are available in the GitHub Issue Tracker CVE report and the VulDB CVE-2026-19384 entry.

Detection Methods for CVE-2026-19384

Indicators of Compromise

HTTP requests to /admin/ajax.php?action=set_appointment containing SQL metacharacters such as ', ", --, UNION, SELECT, or SLEEP( in the ID parameter
Web server or application logs showing unusually long or URL-encoded ID values
Database error messages returned in HTTP responses referencing MySQL syntax errors
Unexpected outbound queries or spikes in query duration correlating with requests to the affected endpoint

Detection Strategies

Deploy web application firewall rules that identify SQL injection patterns targeting the ID parameter of set_appointment
Enable database query logging and alert on queries containing tautologies such as OR 1=1 or stacked statements against the appointment tables
Correlate access logs with authentication events to identify unauthenticated hits against the /admin/ path

Monitoring Recommendations

Monitor for repeated 200-status requests to /admin/ajax.php from a single source with varying ID values, indicating enumeration
Track database user activity for unexpected information_schema reads originating from the web application service account
Alert on outbound data volume increases from the web tier that could indicate data exfiltration

How to Mitigate CVE-2026-19384

Immediate Actions Required

Restrict network access to the /admin/ path using IP allowlists or authenticated reverse proxies until a fix is applied
Take the application offline if it hosts real patient data, as the endpoint is unauthenticated and public exploit details exist
Audit the appointment and admin database tables for unauthorized reads or modifications since deployment

Patch Information

No vendor patch has been published for SourceCodester Simple Doctors Appointment System 1.0 at the time of this writing. Administrators must apply source-level fixes: replace the vulnerable SQL statement in admin/ajax.php with a prepared statement using parameter binding, and cast the ID value to an integer before use. Refer to the SourceCodester project page for any subsequent releases.

Workarounds

Add server-side input validation that rejects any ID value that is not a positive integer
Configure the database account used by the application with least-privilege permissions, denying access to information_schema and other sensitive tables
Deploy a web application firewall with signatures for SQL injection targeting PHP AJAX handlers
Disable or remove the set_appointment action if it is not required for production operations

bash

# Example WAF-style filter to block common SQLi payloads on the affected endpoint
# (adapt to your WAF or reverse proxy syntax)
location /admin/ajax.php {
    if ($arg_action = "set_appointment") {
        if ($arg_id ~* "('|\"|--|;|union|select|sleep|benchmark|information_schema)") {
            return 403;
        }
    }
}