The vulnerability exists in the admindocview.php component of the online-clinic-management-system, where the docid argument is concatenated directly into a SQL statement. This allows an attacker to inject arbitrary SQL code and perform unauthorized read or write operations against the database. The weakness aligns with CWE-74 and CWE-89, reflecting improper input handling and direct SQL injection. As a result, an attacker could exfiltrate sensitive patient records, modify appointment data, or delete entries, compromising confidentiality, integrity, and potentially availability of the clinical system.

Affected systems are installations of subhajitkhan’s online-clinic-management-system, any version up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578. Because the project follows a rolling release model, specific patch versions are not publicly available and end‑users cannot determine whether their deployment includes the fix without manually checking the codebase.

The CVSS score of 6.9 indicates moderate severity; the EPSS score is not available, leaving the current exploitation probability uncertain. The vulnerability is publicly disclosed and can be triggered remotely, but the description does not specify whether authentication is required; based on the description, it is inferred that authentication may not be required, though this is not confirmed, which elevates the risk if access to the administrative interface is unrestricted. The product is not listed in the CISA KEV catalog, but the lack of a known patch and the remote nature of the attack suggest that active monitoring and mitigation are prudent until a proper fix is released.