Technical impact
This vulnerability allows an attacker to inject arbitrary SQL statements by manipulating the Username parameter in the Admin Login component of the Online Clinic Management System. The injection can be executed remotely through the login.php script, potentially allowing the attacker to read, modify, or delete data from the underlying database, compromising confidentiality and integrity. The issue is classified as CWE‑74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE‑89 (SQL Injection).
Affected Systems
The affected product is itsourcecode Online Clinic Management System version 1.0. The vulnerability resides in the file success/login.php of the Admin Login component. No other versions or products are listed as affected.
Risk and Exploitability
The CVSS score is 6.9, indicating a medium to high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, which suggests it is not a widely exploited vulnerability at present. However, the attack vector is remote, relying on web-based interaction. An attacker can exploit the flaw without authentication by sending a crafted Username value to the login page, which may yield SQL injection. The absence of immediate mitigations increases the risk for systems still running the vulnerable version.
