| عنوان | subhajitkhan online-clinic-management-system e9ee77a8827a1446220fa07ee693dc4d9a29a578 Cleartext Storage of Sensitive Information |
|---|
| الوصف | patientregistration.php inserts pat_pswd directly into pat_registration at lines 28-32, and doctorregistration.php does the same for doc_pswd at lines 39-42. Authentication in patientlogin.php line 8 and doctorlogin.php line 8 compares the submitted secret in SQL rather than verifying a password hash. patdetails.php line 90, docdetails.php line 102, and admindetails.php line 96 additionally render the stored password into HTML. Runtime verification confirmed that the database and profile pages retained the exact submitted password strings. Database disclosure therefore exposes reusable credentials without any cracking step. |
|---|
| المصدر | ⚠️ https://github.com/subhajitkhan/online-clinic-management-system/issues/9 |
|---|
| المستخدم | yuanchao (UID 99964) |
|---|
| ارسال | 09/10/2026 12:31 PM (13 أيام منذ) |
|---|
| الاعتدال | 22/10/2026 10:26 AM (13 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 425220 [subhajitkhan online-clinic-management-system حتى e9ee77a8827a1446220fa07ee693dc4d9a29a578 patientregistration.php pat_pswd/doc_pswd تشفير ضعيف] |
|---|
| النقاط | 20 |
|---|