Online Hospital Management System CVE-2026-10299

Authentication with a high-privilege account (PR:H per CVSS 4.0 vector) is required - unauthenticated exploitation is not possible. The specific vulnerable endpoint is viewdoctortimings.php and exploitation requires the ability to send a crafted HTTP request with a manipulated delid parameter value referencing an arbitrary record ID. No special non-default configuration is required beyond having the application deployed and accessible over the network. Exploitation is limited by: (1) the attacker must already hold high-privileged application credentials, (2) the application must be network-accessible (self-hosted deployments may be internal-only), and (3) impact is confined to integrity and availability of doctor timing records within the vulnerable component only - no lateral movement to subsequent systems (SC:N, SI:N, SA:N) is indicated by the CVSS vector. The discrepancy between the 'Information Disclosure' tag and the VC:N CVSS metric means confidentiality impact has not been independently confirmed and should not be assumed.

Real-world risk is constrained to low-to-moderate despite the presence of a public POC. The CVSS 4.0 score of 2.0 is consistent with the PR:H requirement - an attacker must already hold high-privileged credentials within the application before exploitation is possible, dramatically narrowing the threat actor population. The CVSS vector confirms no confidentiality impact (VC:N), meaning the IDOR does not expose sensitive patient or doctor records to reading; instead, integrity (VI:L) and availability (VA:L) impacts reflect unauthorized deletion or modification of doctor timing entries. The 'Information Disclosure' tag in the source intelligence appears inconsistent with the VC:N CVSS metric - this discrepancy should be verified with the vendor or by reviewing the POC, as the actual impact scope may differ from the tag. EPSS data was not provided; given the niche deployment scope of a single open-source PHP hospital system with a high-privilege prerequisite, widespread automated exploitation is unlikely. This vulnerability is not listed in the CISA KEV catalog. The POC is a GitHub markdown writeup, suggesting it is a researcher-authored disclosure rather than weaponized tooling. Priority is low for most organizations; hospitals or clinics self-hosting this specific application should treat it as elevated due to operational data sensitivity.

An attacker who has obtained high-privileged credentials to the Online Hospital Management System - through credential theft, phishing of an admin account, or insider access - navigates to viewdoctortimings.php and manipulates the delid parameter to reference the numeric ID of a doctor timing record they do not own or administer. By iterating through plausible integer ID values (IDOR enumeration), the attacker can delete or alter scheduling records for arbitrary doctors, disrupting hospital operational scheduling. A public proof-of-concept writeup on GitHub details this manipulation technique, lowering the bar for any authenticated attacker to reproduce it.