Description

A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is an unknown function of the file listdoctor.php. Performing a manipulation of the argument searchtext results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-14T10:17:05.233Z",
  "pubdate": "2026-09-14T10:17:05.233Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the subhajitkhan online-clinic-management-system, specifically within the listdoctor.php file.\nThe vulnerability allows remote, unauthenticated attackers to manipulate the 'searchtext' argument, leading to unauthorized interaction with the underlying database.\nAs the application utilizes a rolling release model, the vulnerability affects the codebase up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578.\nThis flaw presents a severe risk, as successful exploitation could lead to unauthorized data exfiltration, modification of clinical records, or potential compromise of the database management system.\nThe exploit is currently public, significantly increasing the risk of active exploitation by malicious actors.\nThe maintainers have been notified of the issue but have not provided a patch or formal response, leaving systems exposed.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw residing in the listdoctor.php component of the online-clinic-management-system.\nThe root cause of this security defect is the improper sanitization and validation of the user-supplied 'searchtext' input parameter before it is incorporated into a dynamic SQL query.\nWhen a user submits a query to the listdoctor.php script, the application fails to utilize parameterized queries or prepared statements, allowing the user to break out of the intended data context and inject arbitrary SQL commands.\nThe attack flow begins when an attacker sends a crafted HTTP request to the listdoctor.php endpoint, passing malicious SQL fragments via the 'searchtext' parameter. Because the application processes this input directly, the database engine executes the injected SQL commands as part of the backend query context.\nThis behavior permits an attacker to perform unauthorized database operations, including the extraction of sensitive clinical data, enumeration of tables, and potentially the modification or deletion of records, depending on the privileges of the database user account utilized by the application.\nSince the vulnerability is exploitable remotely, an adversary does not need prior access to the system or specific user credentials to initiate the attack. The public availability of exploit code lowers the barrier to entry, enabling automated or scripted exploitation attempts against exposed installations.\nThe impact of a successful injection can extend beyond simple data retrieval; if the database user possesses sufficient permissions, an attacker may leverage advanced SQL injection techniques to execute administrative commands or perform operations that compromise the integrity and availability of the system.\nGiven that the project uses a rolling release model and the current codebase remains unpatched, all deployments utilizing versions up to e9ee77a8827a1446220fa07ee693dc4d9a29a578 are considered susceptible to this attack vector."
}