Executive brief
An online clinic management system fails to validate administrator authentication before executing sensitive operations. A network attacker can bypass authorization checks to read patient appointment and feedback data, approve or disable doctors, and cancel appointments without logging in. This exposes confidential patient information and allows unauthorized modification of clinic operations.
Technical details
The vulnerability is an authorization bypass in multiple administrative PHP scripts (adminappview.php, approve.php, disadd.php, admindocview.php, adminfeedbackview.php) that call session_start() but never validate the presence or validity of $_SESSION['adminmail'] before executing database queries and mutations. An unauthenticated network attacker can directly invoke these endpoints via HTTP POST/GET requests without a session cookie to read sensitive patient data, approve/disable doctors, and cancel appointments. The vulnerable functions manipulate the argument adminmail without proper authentication checks. The project operates on rolling release basis with no versioning; the vulnerability existed at least through commit e9ee77a8827a1446220fa07ee693dc4d9a29a578. A patch has not been released.
Affected products
- subhajitkhan online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578
Timeline
- 2026-08-13: disclosed: Issue #4 reported on GitHub
- 2026-09-15: advisory: CVE-2026-90858 published