CVE-2026-3981

itsourcecode Online Doctor Appointment System doctor_action.php sql injection

View on CVE.org
Published Mar 12, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in itsourcecode Online Doctor Appointment System 1.0. Affected is an unknown function of the file /admin/doctor_action.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Analysis

AI-generated

Technical impact

An unknown function within the admin/doctor_action.php file allows an attacker to manipulate the ID parameter, creating an SQL injection vulnerability. This flaw permits the execution of arbitrary SQL statements against the database, potentially revealing, altering, or deleting sensitive data. The weakness corresponds to parameter handling flaws and lack of input validation.

Affected Systems

The vulnerability affects the Online Doctor Appointment System produced by itsourcecode. All installations of version 1.0 are vulnerable, as the issue resides in a universally present script in the specified web application.

Risk and Exploitability

The CVSS score of 6.9 places the issue in the medium severity range. Exploit probability is low, with an EPSS score below 1 percent, and the vulnerability is not listed in the CISA KEV catalog. Inferred from the description, the attack vector is remote over the network, leveraging publicly available exploit code to submit malicious requests directly to the vulnerable endpoint.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the vendor's website or support portal for a patch or updated version that resolves the SQL injection in doctor_action.php
  • If no patch is released, modify doctor_action.php to validate or cast the ID parameter to an integer, or replace raw SQL with prepared statements to prevent injection
  • Restrict access to the /admin directory through IP whitelisting or additional authentication controls until a fix is applied
  • Monitor application logs and network traffic for unusual queries or error messages related to doctor_action.php for early detection of exploitation attempts

Generated by OpenCVE AI on March 20, 2026 at 15:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Unguardable
Unguardable online Doctor Appointment System
CPEs cpe:2.3:a:unguardable:online_doctor_appointment_system:1.0:*:*:*:*:*:*:*
Vendors & Products Unguardable
Unguardable online Doctor Appointment System
Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester doctor Appointment System
Vendors & Products Sourcecodester
Sourcecodester doctor Appointment System
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in itsourcecode Online Doctor Appointment System 1.0. Affected is an unknown function of the file /admin/doctor_action.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Title itsourcecode Online Doctor Appointment System doctor_action.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Mar 12, 2026, 2:41 PM
Reserved
Mar 11, 2026, 2:28 PM

View source JSON

Updated
Mar 12, 2026, 2:41 PM

JSON

Status
Analyzed
Published
Mar 12, 2026, 5:16 AM
Modified
Jun 17, 2026, 10:44 AM

View source JSON

No data.

Updated
Mar 20, 2026, 3:36 PM

JSON