SQL Injection in online-clinic-management-system

A SQL injection vulnerability has been identified in the subhajitkhan online-clinic-management-system, affecting all versions up to commit hash e9ee77a8827a1446220fa07ee693dc4d9a29a578. The flaw resides in the listdoctor.php file, specifically within the handling of the searchtext parameter. An unauthenticated remote attacker can inject malicious SQL statements into this input field to manipulate backend database queries. This vulnerability allows for unauthorized data extraction, modification, or deletion from the underlying database. The vulnerability was disclosed via a public issue report, and as of the current intelligence, the project maintainer has not provided a security patch or a specific release version to resolve the flaw. Given the nature of the software as a clinic management system, the potential impact includes the exposure of sensitive patient and administrative medical data.

Impact

Successful exploitation of CVE-2026-90701 allows an unauthenticated attacker to execute arbitrary SQL commands against the application's database. This may lead to a full compromise of the database content, including personally identifiable information (PII) and medical records stored within the online-clinic-management-system. The lack of a patch means all current deployments using the affected commit range are at risk of data breach or loss until the maintainers remediate the vulnerable parameter.

Recommendation

• Perform a code review of listdoctor.php in your deployment to implement parameterized queries or prepared statements for the searchtext parameter.
• Monitor web application logs for suspicious HTTP GET or POST requests directed at listdoctor.php containing SQL control characters or keywords (e.g., SELECT, UNION, --, OR 1=1).
• Implement a Web Application Firewall (WAF) rule to block common SQL injection patterns targeting the searchtext parameter on the listdoctor.php endpoint.
• If the application is internet-facing, restrict access to the affected directory via IP allowlisting until a formal security update is provided by the project.