Online Clinic Management System EUVD-2026-64828

No special conditions are required for exploitation - the vulnerable parameter (Username) is located in the pre-authentication Admin Login form and is reachable by any network client without credentials, session tokens, or user interaction, consistent with the CVSS 4.0 vector PR:N/UI:N/AC:L. Exploitation is limited by: (1) network accessibility of the admin login page - if the endpoint is restricted to internal networks or specific IP ranges, remote exploitation is blocked; (2) deployment of a WAF capable of detecting SQL injection patterns before they reach the PHP interpreter; (3) the product's niche deployment footprint, which naturally reduces the number of reachable targets. No non-default configuration or specific feature flag is required to be vulnerable.

The CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a low-complexity, network-accessible, unauthenticated attack with no required user interaction - a worst-case delivery profile. The supplemental E:P metric confirms publicly available exploit code, compressing the time-to-exploitation window significantly. Impact metrics are rated Low across VC/VI/VA on the vulnerable system, consistent with an application-scoped database breach rather than OS-level compromise. No CISA KEV listing exists, but the combination of PR:N, AV:N, and public POC means even a mid-sized municipal IT team in gniezno managing a deployment of this software should treat this as urgent rather than routine patching. The absence of EPSS data from the provided intelligence is a gap; given the public POC and low attack complexity, real-world exploitation probability is likely non-trivial. No conflicting signals exist between the CVSS vector and description - both consistently indicate unauthenticated remote exploitation against the login form.

An attacker identifies an internet-facing instance of Online Clinic Management System 1.0 and navigates to the Admin Login page at success/login.php. Using the publicly available POC (GitHub microwaveabi/vul issue #63), they submit a crafted Username value such as ' OR '1'='1 or a UNION-based payload to extract the database schema and user credentials, or to bypass authentication entirely and access the admin dashboard. No credentials or prior knowledge of the target system are required.