Online Clinic System CVE-2026-112139

Exploitation requires reaching the admindocview.php script and supplying a malicious value in the 'docid' GET/POST argument, which is passed unsanitized into a SQL query (CWE-89). The supplied CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required; however, the file resides in the application's Administrative Mutation Handler, so if the admin area enforces a login, valid administrator credentials would be a real prerequisite - this authentication boundary is the key limiting factor to verify. No fixed release exists because the project uses a rolling-release model and the maintainer has not responded, so exposure persists until patched manually or the endpoint is restricted.

Signals are consistent but point to moderate, not critical, risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity SQL injection, but impact is rated only partial across all three dimensions (VC:L/VI:L/VA:L), yielding a 6.9 (Medium). Exploit maturity is E:P (proof-of-concept), and the input confirms a publicly available exploit, so the barrier to opportunistic abuse is low. However, there is NO EPSS score, NO SSVC decision data, and NO CISA KEV listing provided, so there is no evidence of active or automated exploitation - this is a disclosed PoC, not a confirmed in-the-wild campaign. A notable conflict: the affected file is 'admindocview.php' within an 'Administrative Mutation Handler', which strongly implies an authenticated admin context, yet the vector asserts PR:N (unauthenticated). This discrepancy should be verified against the actual code/access control - if the admin panel requires a login, real-world exploitability is materially lower than the PR:N vector suggests. Mitigating the risk further, the affected product is an obscure student/hobby GitHub project with negligible deployment footprint. Net: a genuine, easily exploitable flaw in principle, but low practical priority for most organizations given minimal prevalence and unconfirmed authentication requirements.

A remote attacker sends a crafted value in the 'docid' parameter to admindocview.php, injecting SQL that the backend executes against the clinic database. Because a public proof-of-concept exists (referenced via the project's GitHub issue tracker) and complexity is low, an attacker could extract or alter patient/doctor records; if the endpoint truly requires no authentication as the CVSS vector claims, this is directly reachable, otherwise valid admin access would first be needed.