# CVE-2026-78246: itsourcecode Online Clinic Management System SQL injection in admin login

Source: https://junglewise.ai/threats/cve-2026-78246-itsourcecode-online-clinic-management-system-sql-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78246 · Severity: high · CVSS 7.3 · Published 2026-08-24

The Online Clinic Management System is a web application used to manage patient records, prescriptions, and medical equipment in healthcare clinics. An attacker can bypass administrator authentication and gain complete access to all patient data through a SQL injection vulnerability in the login form. This allows unauthorized access to sensitive medical records and full control over the clinic's systems.

Technologies: [Itsourcecode Online Clinic Management System](https://junglewise.ai/threats/technologies/online-clinic-management-system). Vendors: [Itsourcecode](https://junglewise.ai/threats/vendors/itsourcecode).

## Quick answers

**Is CVE-2026-78246 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78246 being exploited in the wild.

**How severe is CVE-2026-78246?** High severity, with a CVSS score of 7.3, published 24 August 2026.

**Which products and versions are affected?** Itsourcecode Online Clinic Management System 1.0.

**Is there a fix for CVE-2026-78246?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78246 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-78246?** Check whether you run Itsourcecode Online Clinic Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a SQL injection in the admin login component (success/login.php) caused by insufficient input sanitization. The application uses htmlspecialchars() with the ENT_COMPAT flag, which only escapes double quotes but not single quotes. User-supplied username input is concatenated directly into a SQL query without prepared statements. An attacker can inject SQL by submitting a username like "admin'#" to comment out the password check and bypass authentication. The vulnerability is network-accessible without authentication prerequisites, allowing remote authentication bypass and full database access via union-based SQL injection.

## Affected products

- itsourcecode Online Clinic Management System 1.0

## Timeline

- 2026-07-11: disclosed: Vulnerability disclosed on GitHub issue #63
- 2026-08-24: advisory: CVE-2026-78246 published to NVD

## References

- [https://github.com/microwaveabi/vul/issues/63](https://github.com/microwaveabi/vul/issues/63)
- [https://itsourcecode.com/](https://itsourcecode.com/)