| tiêu đề | subhajitkhan online-clinic-management-system e9ee77a8827a1446220fa07ee693dc4d9a29a578 Authorization Bypass |
|---|
| Mô tả | Administrative scripts call `session_start()` and read `$_SESSION['adminmail']` but never test that it exists or belongs to an administrator. `adminappview.php` lines 21-36 delete appointments and list every appointment, including patient contact data at lines 147-167; `approve.php` lines 9-13 and `disadd.php` lines 9-13 change doctor status; `admindocview.php` lines 22-30 deletes doctors; and `adminfeedbackview.php` lines 9-10 returns all feedback. Requests without a session cookie were verified to disclose a patient's name and phone number, approve a doctor, and delete an appointment. This allows any remote user to read sensitive clinic data and alter or destroy administrative records.
|
|---|
| Nguồn | ⚠️ https://github.com/subhajitkhan/online-clinic-management-system/issues/4 |
|---|
| Người dùng | ovoxyc (UID 100533) |
|---|
| Đệ trình | 13/08/2026 13:53 (cách đây 1 tháng) |
|---|
| Kiểm duyệt | 14/09/2026 07:54 (1 month later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 403415 [subhajitkhan online-clinic-management-system đến e9ee77a8827a1446220fa07ee693dc4d9a29a578 adminappview.php session_start adminmail nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|