What happened
A critical security vulnerability has been identified in the girishsaraf Online-Appointment-Booking-System, affecting versions up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The flaw resides in an unspecified function of the file changebookingstatus.php, where manipulation of the argument dateselected could lead to SQL injection. This vulnerability has been exploited actively in the wild, with attackers able to access affected systems remotely without prior authentication or user interaction. The exploit involves directly targeting an exposed service, allowing attackers to execute malicious SQL commands, potentially leading to data compromise and partial impact on system integrity and confidentiality.
Who is affected
Organisations operating instances of the girishsaraf Online-Appointment-Booking-System, particularly those running versions prior to or matching f427b4757128ca253d33d0cc4e87bbb9c999a4d5, are at risk. Since the vulnerability is exploitable remotely through network services, any deployment exposed to the internet without additional access controls or network segmentation could be affected. The vulnerability’s high severity and active exploitation highlight a significant threat to affected organisations.
Recommended actions
Implement network access controls to restrict exposure of the Online-Appointment-Booking-System service to trusted networks only.
Ensure that network segmentation is in place to isolate affected services from broader organisational networks.
Review and strengthen perimeter security controls, such as firewalls and intrusion prevention systems, to detect and block potential exploitation attempts.
Monitor network traffic for indicators of compromise associated with this vulnerability and active exploitation efforts.
