EUVD-2026-77342
GHSA-gm8g-cfvq-jfxp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing listdoctor.php endpoint
-
DeliverySend crafted searchtext parameter with SQL payload
-
ExploitBackend query executes injected SQL
-
ExecutionExtract database schema and table contents
-
ImpactHarvest patient records or credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions required beyond network access to the web application. The |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction - the highest-risk access profile. However, the supplied impact metrics (VC:L/VI:L/VA:L) appear conservative: SQL injection in a PHP web application typically grants full read access to all database tables (including credentials, patient records) and write capability, which would justify VC:H/VI:H. The 6.9 score likely reflects the niche deployment footprint rather than a genuine impact ceiling. The publicly available PoC (E:P in the CVSS 4.0 vector) lowers the exploitation bar significantly. No CISA KEV listing, and EPSS data is not provided, but the combination of PR:N, no patch, unresponsive maintainer, and live PoC constitutes a meaningful risk for any organization running this software. Key limiting factor: this is an obscure, low-adoption open-source project, dramatically reducing real-world exposure. |
| Exploit ScenarioDerived | An unauthenticated attacker sends an HTTP request to the publicly accessible |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 14, 2026
SQL injection in the searchtext parameter of listdoctor.php in subhajitkhan's online-clinic-management-system exposes the backend database to unauthenticated remote attackers. The flaw allows direct manipulation of SQL queries, potentially enabling full database enumeration and data modification. A public proof-of-concept exists via GitHub issue, the maintainer has not responded to disclosure, and no patch has been released for this rolling-release project.
RemediationAI
No vendor-released patch is available at time of analysis; the maintainer had not responded to the responsible disclosure report. Organizations running this software should immediately restrict access to listdoctor.php at the web server or firewall level if the search feature is not externally required. The definitive fix requires rewriting the SQL query in listdoctor.php to use prepared statements with parameterized queries (PDO or MySQLi). As a compensating control, deploying a WAF rule blocking common SQLi patterns (single quotes, UNION SELECT, comment sequences) on the searchtext parameter can reduce exposure, though WAF bypass is possible. Given the unresponsive maintainer, replacing the application or forking and patching the codebase directly is the most reliable remediation path.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is a PHP-based web application for clinic management (CPE: cpe:2.3:a:subhajitkhan:online-clinic-management-system:*:*:*:*:*:*:*:*). CWE-89 (SQL Injection) identifies the root cause: the searchtext GET/POST parameter passed to listdoctor.php is interpolated directly into a backend SQL query without parameterization, escaping, or allowlist validation. This is a classic unsanitized user-input pattern endemic to PHP applications that construct queries via string concatenation. The vulnerable code path is in the doctor search/listing functionality.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-accessible SQLi with no auth; C:H/I:H reflects full DB read/write typical of unsanitized SQL; A:L as availability impact is limited to data manipulation rather than service disruption.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is an unknown function of the file listdoctor.php. Performing a manipulation of the argument searchtext results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB