Executive brief
A vulnerability exists in the Online Hospital Management System, a web application used for managing medical facility operations. An attacker can exploit this flaw to delete doctor schedule records that do not belong to them. This can lead to significant operational disruption, including the loss of appointment data and conflicts in hospital scheduling.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the 'viewdoctortimings.php' file of the Online Hospital Management System 1.0. The application fails to perform ownership or authorization checks when processing the 'delid' GET parameter used for deleting doctor timing records. An attacker can manipulate this parameter to delete arbitrary records from the 'doctor_timings' database table. While the reported CVSS indicates high privileges are required, the technical analysis suggests the endpoint may lack session validation entirely, potentially allowing unauthenticated remote attackers to perform mass deletion of schedule data via IDOR enumeration.
Affected products
- code-projects Online Hospital Management System 1.0
Timeline
- 2026-06-01: disclosed
- 2026-06-01: advisory
References
- https://code-projects.org/
- https://github.com/Carm3nc1ta/vuln-test/blob/main/Online%20Hospital%20Management%20System%20has%20IDOR%20vulnerability%20in%20viewdoctortimings_php.md
- https://vuldb.com/cve/CVE-2026-10299
- https://vuldb.com/submit/827505
- https://vuldb.com/vuln/367592
- https://vuldb.com/vuln/367592/cti