Executive brief
The eDoc Doctor Appointment System, a web application for managing medical bookings, contains a security flaw that allows unauthorized individuals to delete records. By accessing specific administrative web addresses without logging in, an attacker can remove appointment sessions, doctor profiles, and patient bookings. This could lead to significant operational disruption, loss of medical scheduling data, and a breakdown in patient-provider communication.
Technical details
A missing authorization vulnerability (CWE-862) exists in SourceCodester eDoc Doctor Appointment System 1.0. The application fails to implement access control checks on administrative scripts including /admin/delete-session.php, /admin/delete-appointment.php, and /admin/delete-doctor.php. A remote, unauthenticated attacker can send crafted HTTP GET requests to these endpoints and manipulate the 'id' parameter to delete arbitrary records from the database. A public proof-of-concept exploit has been released demonstrating that these administrative actions can be performed without a valid session or administrative privileges.
Affected products
- SourceCodester eDoc Doctor Appointment System 1.0
Timeline
- 2026-05-26: disclosed: Public proof of concept released on GitHub
- 2026-05-26: advisory: NVD and VulDB published advisory
References
- https://github.com/NARKHEDE-VAIBHAV/poc/blob/main/CVE-2026-9603-Missing-Authorization/Advisory.md
- https://github.com/NARKHEDE-VAIBHAV/poc/blob/main/CVE-2026-9603-Missing-Authorization/poc.sh
- https://vuldb.com/submit/817935
- https://vuldb.com/vuln/365676
- https://vuldb.com/vuln/365676/cti
- https://www.sourcecodester.com/