CVE-2026-19384: SQL Injection in SourceCodester Simple Doctors Appointment System

Executive Summary

CVE-2026-19384 is a SQL injection vulnerability in SourceCodester Simple Doctors Appointment System 1.0. The flaw resides in the /admin/ajax.php endpoint when the action parameter is set to set_appointment. An attacker can manipulate the ID argument to inject arbitrary SQL into the backend database query.

The vulnerability is remotely exploitable with no authentication required, and has been assigned a CVSS base score of 7.3 (High).

Vulnerability Details

Technical Analysis

Vulnerable Code Path

The vulnerability exists in the administrative AJAX handler at /admin/ajax.php. When action=set_appointment is submitted, the application passes the ID parameter directly into a SQL query without adequate sanitization or parameterization:

GET /admin/ajax.php?action=set_appointment&ID=1 OR 1=1-- HTTP/1.1
Host: target.example.com

The unsanitized ID value is interpolated into the query string, allowing an attacker to alter the query's logic, extract data, or bypass access controls.

Potential Impact

Successful exploitation of this SQL injection vulnerability could allow an attacker to:

• Bypass authentication — Alter query logic to gain unauthorized access to the appointment management panel
• Extract sensitive data — Dump patient appointment records, personal information, and credentials stored in the database
• Modify or delete records — Tamper with appointment scheduling data
• Escalate to RCE — On misconfigured MySQL deployments, leverage INTO OUTFILE or LOAD_FILE() for file-system access

Affected Systems

This vulnerability affects healthcare appointment management installations running:

• SourceCodester Simple Doctors Appointment System version 1.0

SourceCodester products are widely used in educational and small-business contexts. Healthcare-adjacent deployments handling patient data are at elevated risk if exposed to the internet.

Remediation

Immediate Actions

1. Take the affected endpoint offline if internet-exposed until a patch is available
2. Apply a Web Application Firewall (WAF) rule to block SQL injection patterns on the /admin/ajax.php endpoint
3. Restrict admin panel access to trusted IP ranges only
4. Audit database logs for signs of prior exploitation (unusual UNION, OR 1=1, or -- patterns in query logs)

Developer Fix

The correct remediation is to replace string interpolation with parameterized queries (prepared statements):

// Vulnerable (DO NOT USE)
$query = "SELECT * FROM appointments WHERE id = " . $_GET['ID'];
 
// Fixed — use prepared statements
$stmt = $pdo->prepare("SELECT * FROM appointments WHERE id = ?");
$stmt->execute([$_GET['ID']]);

Additionally, enforce input validation to ensure ID contains only integer values before any database interaction.

Detection

Indicators of Exploitation

Look for the following patterns in web server access logs:

/admin/ajax.php?action=set_appointment&ID=1+OR+1%3D1--
/admin/ajax.php?action=set_appointment&ID=1+UNION+SELECT+...
/admin/ajax.php?action=set_appointment&ID=1';+DROP+TABLE+--

WAF Signatures

Most major WAF vendors (Cloudflare, ModSecurity, AWS WAF) detect standard SQL injection payloads via managed ruleset. Ensure these are enabled for the /admin/ path.

References

• NVD — CVE-2026-19384
• SourceCodester Simple Doctors Appointment System
• CWE-89: Improper Neutralization of Special Elements used in an SQL Command

Related Advisories

• BeyondTrust CVE-2026-1731 Remote Code Execution
• Apache Struts RCE CVE-2026-3098