Key Information Summary Affected Product Product Name: Online Appointment Booking System Version: V1.0 Vulnerability Details Vulnerability Type: SQL Injection Affected File: cover.php Parameter: username Vulnerability Description Root Cause: In the file, the parameter input is not properly sanitized or validated, and is directly used in SQL queries. Impact: Attackers can exploit this vulnerability to perform SQL injection attacks, leading to unauthorized database access, data leakage, data tampering, system compromise, and exposure of sensitive information. Exploitation Method No Authentication Required: Attackers can exploit this vulnerability without logging in or having authorization. HTTP Request Payload Example: Recommended Remediation Measures 1. Use Prepared Statements and Parameter Binding: Prepared statements prevent SQL injection by separating SQL code from user input data. 2. Input Validation and Filtering: Strictly validate and filter user input data to ensure it conforms to expected formats. 3. Minimize Database User Privileges: Database user privileges should be limited to the minimum required for task execution. 4. Regular Security Audits: Conduct regular code and system security audits to promptly identify and fix potential security vulnerabilities.