PT-2025-46877 · Sourcecodester · Patients Waiting Area Queue Management System
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
SourceCodester Patients Waiting Area Queue Management System version 1.0
Description
A flaw exists in the software that allows for remote SQL injection. The issue is located in the
getPatientAppointment function within the /php/api patient checkin.php file. Manipulation of the appointmentID argument can trigger the injection. The exploit for this issue is publicly available.Recommendations
Apply a fix to the
getPatientAppointment function in the /php/api patient checkin.php file to prevent manipulation of the appointmentID argument.Exploit
Fix
Special Elements Injection
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Patients Waiting Area Queue Management System