Executive brief
The Online Clinic Management System is a web application used to manage patient records, prescriptions, and medical equipment in healthcare clinics. An attacker can bypass administrator authentication and gain complete access to all patient data through a SQL injection vulnerability in the login form. This allows unauthorized access to sensitive medical records and full control over the clinic's systems.
Technical details
The vulnerability is a SQL injection in the admin login component (success/login.php) caused by insufficient input sanitization. The application uses htmlspecialchars() with the ENT_COMPAT flag, which only escapes double quotes but not single quotes. User-supplied username input is concatenated directly into a SQL query without prepared statements. An attacker can inject SQL by submitting a username like "admin'#" to comment out the password check and bypass authentication. The vulnerability is network-accessible without authentication prerequisites, allowing remote authentication bypass and full database access via union-based SQL injection.
Affected products
- itsourcecode Online Clinic Management System 1.0
Timeline
- 2026-07-11: disclosed: Vulnerability disclosed on GitHub issue #63
- 2026-08-24: advisory: CVE-2026-78246 published to NVD