| शीर्षक | subhajitkhan online-clinic-management-system e9ee77a8827a1446220fa07ee693dc4d9a29a578 Client-Side Enforcement of Server-Side Security |
|---|
| विवरण | patappointtime.php checks only booking count and inserts an appointment at lines 75-87 before any payment step. patpay.php lines 15-25 does not validate card data, communicate with a payment provider, create a transaction record, or update an appointment status; it only emits JavaScript that redirects to patappview.php. A verified booking request produced the "Proceed to pay" page and persisted the appointment before any request to patpay.php. Any authenticated patient can reserve paid appointments without paying, causing revenue loss and schedule exhaustion. |
|---|
| स्रोत | ⚠️ https://github.com/subhajitkhan/online-clinic-management-system/issues/10 |
|---|
| उपयोगकर्ता | yuanchao (UID 99964) |
|---|
| सबमिशन | 09/10/2026 12:32 PM (14 दिन पहले) |
|---|
| संयम | 22/10/2026 10:26 AM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 425221 [subhajitkhan online-clinic-management-system तक e9ee77a8827a1446220fa07ee693dc4d9a29a578 Booking patappointtime.php अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|