Description

A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient_login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-03T23:17:20.630Z",
  "pubdate": "2026-09-03T23:17:20.630Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the Doctor Appointment System 1.0. The vulnerability exists within the /patient_login.php script, specifically affecting the handling of the 'email' input parameter.\nThis flaw allows a remote, unauthenticated attacker to manipulate backend database queries by injecting arbitrary SQL commands. Successful exploitation could lead to unauthorized data access, modification, or deletion of sensitive patient records, potentially resulting in full database compromise.\nGiven that exploit code is publicly available, the risk of exploitation is significantly elevated. The vulnerability facilitates unauthorized access to the application's data layer without requiring prior authentication. Security teams should prioritize addressing this input validation failure immediately to prevent unauthorized information disclosure or integrity loss.",
  "technicalDetails": "The vulnerability originates from improper input sanitization and lack of parameterized queries within the /patient_login.php script of the Doctor Appointment System 1.0. The application fails to adequately sanitize the 'email' argument before incorporating it into a database query string.\nWhen a user submits login credentials, the application dynamically constructs a SQL statement, likely using unsanitized user input. By supplying a specially crafted payload via the 'email' field, an attacker can break out of the intended data context and manipulate the structure of the SQL query. This allows for the injection of malicious SQL commands that are subsequently executed by the database management system (DBMS) with the privileges of the database service account.\nThe attack flow proceeds as follows: First, the attacker identifies the /patient_login.php endpoint as the target for parameter manipulation. Second, the attacker crafts an 'email' payload containing SQL syntax characters (e.g., single quotes, comment delimiters like '--' or '#') designed to alter the query logic, such as bypassing authentication checks or performing UNION-based queries to exfiltrate database content. Third, the crafted request is sent to the web server over HTTP/HTTPS. Finally, the application processes the tainted input, executes the altered SQL query against the backend database, and reflects the results back to the user or performs the requested malicious action.\nThis vulnerability is classified as an injection flaw, specifically SQL injection, occurring at the application layer. The lack of Prepared Statements or parameterized queries is the primary root cause. Because the vulnerability is reachable over the network and does not require pre-existing authentication, the attack surface is exposed to any remote actor capable of reaching the web interface. Post-exploitation impact is severe, potentially enabling complete compromise of the backend database, including unauthorized access to protected health information (PHI) or administrative credentials."
}