| शीर्षक | subhajitkhan online-clinic-management-system e9ee77a8827a1446220fa07ee693dc4d9a29a578 SQL Injection |
|---|
| विवरण | Administrative mutation handlers interpolate attacker-controlled identifiers directly into SQL. `admindocview.php` lines 22-26 builds `DELETE FROM doc_registration where doc_id='$del'`; `adminappview.php` lines 21-25 does the same for appointment deletion; and `approve.php` and `disadd.php` lines 9-13 build status updates from `docid`. A verified request with `docid=' OR '1'='1' -- ` to `admindocview.php` deleted both rows in the test doctor table. The flaw permits predicate manipulation and mass deletion or modification of database records; these endpoints also lack authentication.
|
|---|
| स्रोत | ⚠️ https://github.com/subhajitkhan/online-clinic-management-system/issues/5 |
|---|
| उपयोगकर्ता | 100001001X (UID 100909) |
|---|
| सबमिशन | 04/10/2026 05:32 PM (15 दिन पहले) |
|---|
| संयम | 19/10/2026 07:16 AM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 422244 [subhajitkhan online-clinic-management-system तक e9ee77a8827a1446220fa07ee693dc4d9a29a578 Administrative Mutation admindocview.php docid SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|