| タイトル | subhajitkhan online-clinic-management-system e9ee77a8827a1446220fa07ee693dc4d9a29a578 Cleartext Storage of Sensitive Information |
|---|
| 説明 | patientregistration.php inserts pat_pswd directly into pat_registration at lines 28-32, and doctorregistration.php does the same for doc_pswd at lines 39-42. Authentication in patientlogin.php line 8 and doctorlogin.php line 8 compares the submitted secret in SQL rather than verifying a password hash. patdetails.php line 90, docdetails.php line 102, and admindetails.php line 96 additionally render the stored password into HTML. Runtime verification confirmed that the database and profile pages retained the exact submitted password strings. Database disclosure therefore exposes reusable credentials without any cracking step. |
|---|
| ソース | ⚠️ https://github.com/subhajitkhan/online-clinic-management-system/issues/9 |
|---|
| ユーザー | yuanchao (UID 99964) |
|---|
| 送信 | 2026年10月09日 12:31 (13 日 ago) |
|---|
| モデレーション | 2026年10月22日 10:26 (13 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 425220 [subhajitkhan online-clinic-management-system 迄 e9ee77a8827a1446220fa07ee693dc4d9a29a578 patientregistration.php pat_pswd/doc_pswd 弱い暗号化] |
|---|
| ポイント | 20 |
|---|