Vulnerability feed

Executive summary

The advisory says the edoc doctor appointment system, a PHP and MySQL web application, has an unauthenticated SQL injection flaw in its admin add-new endpoint. An outside attacker could read database contents and create arbitrary doctor accounts without logging in. The advisory does not state a severity score, and it does not state a fixed version or a vendor recommendation beyond general remediation advice in the write-up.

Technical summary

The flaw is an unauthenticated time-based blind SQL injection in POST /admin/add-new.php, via the spec parameter, which is concatenated unquoted into an INSERT statement. The endpoint lacks effective authentication because header() redirects do not terminate script execution, so the SQL runs regardless of session state. The advisory describes the same pattern in 60+ other handlers. It notes that stacked queries are not possible through mysqli::query(), so UPDATE and DELETE are not reachable, and that the webuser INSERT hardcodes usertype 'd'. The affected version is given as commit cc258425b915d1af9e298777ccd26d160493e68d, and the advisory states that the affected version range is up to that commit. A fixed version is not stated. A workaround is not stated beyond the remediation advice to add exit after redirects and use prepared statements. Detection guidance such as log signatures or WAF rules is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from gist.github.com/asdfghjkl12345678910111…2441cca911ecbfaa9acb

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

None

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

HashenUdaraHashenUdara edoc-doctor-appointment-system