CVE-2023-39852: Doctor Appointment System Project Doctor Appointment System

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

Doctormms v1.0 was discovered to contain a SQL injection vulnerability via the $userid parameter at myAppoinment.php. NOTE: this is disputed by a third party who claims that the userid is a session variable controlled by the server, and thus cannot be used for exploitation. The original reporter counterclaims that this originates from $_SESSION["userid"]=$_POST["userid"] at line 68 in doctors\doctorlogin.php, where userid under POST is not a session variable controlled by the server.

Affected products

• Doctor Appointment System Project Doctor Appointment System: version 1.0 only

Published 2023-08-15. Last modified 2026-06-17.