| 제목 | subhajitkhan online-clinic-management-system e9ee77a8827a1446220fa07ee693dc4d9a29a578 Cleartext Storage of Sensitive Information |
|---|
| 설명 | patientregistration.php inserts pat_pswd directly into pat_registration at lines 28-32, and doctorregistration.php does the same for doc_pswd at lines 39-42. Authentication in patientlogin.php line 8 and doctorlogin.php line 8 compares the submitted secret in SQL rather than verifying a password hash. patdetails.php line 90, docdetails.php line 102, and admindetails.php line 96 additionally render the stored password into HTML. Runtime verification confirmed that the database and profile pages retained the exact submitted password strings. Database disclosure therefore exposes reusable credentials without any cracking step. |
|---|
| 원천 | ⚠️ https://github.com/subhajitkhan/online-clinic-management-system/issues/9 |
|---|
| 사용자 | yuanchao (UID 99964) |
|---|
| 제출 | 2026. 10. 09. PM 12:31 (14 날 ago) |
|---|
| 모더레이션 | 2026. 10. 22. AM 10:26 (13 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 425220 [subhajitkhan online-clinic-management-system 까지 e9ee77a8827a1446220fa07ee693dc4d9a29a578 patientregistration.php pat_pswd/doc_pswd 약한 암호화] |
|---|
| 포인트들 | 20 |
|---|