| Title | subhajitkhan online-clinic-management-system e9ee77a8827a1446220fa07ee693dc4d9a29a578 Cleartext Storage of Sensitive Information |
|---|
| Description | patientregistration.php inserts pat_pswd directly into pat_registration at lines 28-32, and doctorregistration.php does the same for doc_pswd at lines 39-42. Authentication in patientlogin.php line 8 and doctorlogin.php line 8 compares the submitted secret in SQL rather than verifying a password hash. patdetails.php line 90, docdetails.php line 102, and admindetails.php line 96 additionally render the stored password into HTML. Runtime verification confirmed that the database and profile pages retained the exact submitted password strings. Database disclosure therefore exposes reusable credentials without any cracking step. |
|---|
| Source | ⚠️ https://github.com/subhajitkhan/online-clinic-management-system/issues/9 |
|---|
| User | yuanchao (UID 99964) |
|---|
| Submission | 10/09/2026 12:31 (13 days ago) |
|---|
| Moderation | 10/22/2026 10:26 (13 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 425220 [subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578 patientregistration.php pat_pswd/doc_pswd missing encryption] |
|---|
| Points | 20 |
|---|