Description

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument doc_mail/doc_pswd can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-14T18:20:27.767Z",
  "pubdate": "2026-09-14T18:20:27.767Z",
  "executiveSummary": "The subhajitkhan online-clinic-management-system, up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578, contains a critical SQL Injection vulnerability.\nThe flaw exists within the 'doctorlogin.php' file, where user-supplied input provided via the 'doc_mail' and 'doc_pswd' parameters is not adequately sanitized or parameterized before being included in database queries.\nThis vulnerability allows an unauthenticated remote attacker to manipulate backend SQL queries, potentially leading to unauthorized data access, modification of administrative credentials, or full database compromise.\nThe vulnerability is currently exposed, with exploit code available in the public domain. Given the lack of a vendor patch, the system remains at high risk for exploitation.\nImmediate remediation is required to sanitize inputs and implement prepared statements to neutralize the injection vector.",
  "technicalDetails": "The vulnerability is a classic SQL Injection (SQLi) arising from the insecure handling of user-controllable input in the authentication module of the online-clinic-management-system. Specifically, the 'doctorlogin.php' script fails to implement prepared statements or parameterization when processing inputs for the 'doc_mail' and 'doc_pswd' fields.\nThe root cause is the direct concatenation of user-provided strings into the SQL query string passed to the underlying database management system. Because the input parameters are not properly escaped or sanitized, an attacker can supply malicious SQL syntax to escape the intended query structure, enabling the execution of arbitrary commands within the database context.\nThe attack flow proceeds as follows: 1) An attacker identifies the 'doctorlogin.php' endpoint, which serves as the authentication gateway for the system. 2) The attacker crafts an HTTP request (typically a POST request) containing specially formulated payload strings within the 'doc_mail' or 'doc_pswd' fields. 3) These strings contain meta-characters (such as single quotes, comments like '--', or UNION operators) that disrupt the query logic. 4) The server-side script executes the modified SQL statement, allowing the attacker to bypass authentication bypass mechanisms (e.g., forcing a query to return a 'true' result regardless of the credentials). 5) Following successful injection, the attacker can leverage further SQL commands to extract data from the database schema, including patient records, staff credentials, or configuration information.\nThe impact of this vulnerability is critical. An attacker can perform a full database dump, modify authentication tables to create new administrative accounts, or delete sensitive clinical data. Because the exploit is remote and requires no prior authentication, it represents a significant threat to the integrity and confidentiality of the clinic's data. Furthermore, because the application utilizes a rolling release model, there is no standardized versioning, complicating the deployment of patches and requiring manual audit of the codebase up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578."
}