EUVD-2025-17108
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability was found in SourceCodester Open Source Clinic Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /email_config.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
SourceCodester Open Source Clinic Management System version 1.0 contains a critical SQL injection vulnerability in the /email_config.php file affecting the 'email' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or system compromise. Public disclosure and exploit code availability significantly elevate real-world risk.
Technical Context
The vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which represents unsafe handling of user input that is subsequently used in SQL queries. The /email_config.php file fails to properly sanitize or parameterize the 'email' parameter before incorporating it into database queries. This classic SQL injection flaw allows attackers to break out of intended SQL syntax and inject malicious SQL statements. The vulnerability affects SourceCodester's clinic management application, a PHP-based open-source system commonly deployed in healthcare settings. The attack requires no authentication (PR:N per CVSS vector) and has low attack complexity (AC:L), making it trivially exploitable via HTTP requests.
Affected Products
SourceCodester Open Source Clinic Management System version 1.0 (all installations). CPE string: cpe:2.3:a:sourcecodester:clinic_management_system:1.0:*:*:*:*:*:*:*. The vulnerability is present in the /email_config.php file specifically. All deployments of version 1.0, regardless of operating system or web server configuration, are vulnerable to remote SQL injection through the email parameter.
Remediation
Immediate actions: (1) Disable or restrict access to /email_config.php via web server configuration (Apache/.htaccess or Nginx location rules) until patching is available; (2) Implement Web Application Firewall (WAF) rules to filter SQL injection payloads in the email parameter (block common keywords: UNION, SELECT, DROP, INSERT, UPDATE); (3) Apply input validation: whitelist email format using strict regex validation (RFC 5322 compliant patterns); (4) Monitor database logs for anomalous SQL queries or access patterns. Long-term: (5) Contact SourceCodester for patch availability or upgrade timeline; (6) If patches are unavailable, consider migrating to an actively maintained clinic management system; (7) Implement parameterized queries/prepared statements throughout the application; (8) Conduct security code review of other PHP files for similar injection vulnerabilities.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today