CVE-2026-116112: HashenUdara edoc-doctor-appointment-system SQL injection in admin add-new

CVE-2026-116112 · Severity: high · CVSS 7.3 · Published 2026-10-26

edoc-doctor-appointment-system is a doctor appointment scheduling web application. An unauthenticated attacker can remotely inject SQL commands through the admin appointment-creation interface, bypassing authentication checks to extract or manipulate patient and doctor data, or create unauthorized accounts. The vulnerability is publicly exploitable and exploits exist in the wild.

Technologies: Hashenudara Edoc-Doctor-Appointment-System. Vendors: Hashenudara.

Quick answers

Is CVE-2026-116112 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-116112 being exploited in the wild.
How severe is CVE-2026-116112?
High severity, with a CVSS score of 7.3, published 26 October 2026.
Which products and versions are affected?
Hashenudara Edoc-Doctor-Appointment-System up to commit cc258425b915d1af9e298777ccd26d160493e68d.
Is there a fix for CVE-2026-116112?
No fixed version is recorded yet. Apply parameterized queries (prepared statements) for all SQL operations. Add exit() or die() immediately after header() calls to prevent further script execution, or use a centralized authentication check at application entry.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-116112 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-116112?
Check whether you run Hashenudara Edoc-Doctor-Appointment-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Apply parameterized queries (prepared statements) for all SQL operations. Add exit() or die() immediately after header() calls to prevent further script execution, or use a centralized authentication check at application entry.</anigation> </invoke>

Technical details

The admin/add-new.php endpoint fails to terminate script execution after emitting a location header, allowing unauthenticated access to proceed. User-controlled input from the "spec" parameter is concatenated directly into a MySQL INSERT statement without quoting or parameterization, enabling time-based blind SQL injection. An attacker can execute arbitrary SQL queries remotely without authentication to read/write database tables, including creation of attacker-controlled doctor accounts.

Affected products

  • HashenUdara edoc-doctor-appointment-system up to commit cc258425b915d1af9e298777ccd26d160493e68d

Timeline

  • 2026-10-26: disclosed
  • exploited: exploit publicly available on GitHub gist

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.