| Title | girishsaraf Online-Appointment-Booking-System f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Missing Authorization |
|---|
| Description | The affected components are the admin display pages such as `Admin/showdoctor.php`, `Admin/showclinic.php`, `Admin/showmanager.php`, and `Admin/showdoctorschedule.php`. These pages query and print data without any session or role check:
```php
<?php
require_once("dbconfig.php");
$result = $conn->query("SELECT * FROM doctor");
// ... echo total count and all rows
?>
```
An unauthenticated attacker can directly request these URLs and read the complete doctor, clinic, and manager records. |
|---|
| Source | ⚠️ https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/14 |
|---|
| User | a86402175 (UID 101298) |
|---|
| Submission | 09/16/2026 15:53 (1 month ago) |
|---|
| Moderation | 10/12/2026 21:04 (26 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 417188 [girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Admin Display Pages Admin/showdoctor.php authorization] |
|---|
| Points | 20 |
|---|