PT-2025-24007 · Sourcecodester · Sourcecodester Open Source Clinic Management System
Mysq
·
Published
2025-06-06
·
Updated
2025-06-11
·
CVE-2025-5716
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
SourceCodester Open Source Clinic Management System version 1.0
Description
A critical vulnerability has been found in the SourceCodester Open Source Clinic Management System. The issue affects an unknown function of the file /login.php. The manipulation of the
email argument leads to SQL injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.Recommendations
For SourceCodester Open Source Clinic Management System version 1.0, consider disabling the
email argument in the /login.php file as a temporary workaround until a patch is available. Restrict access to the /login.php file to minimize the risk of exploitation. Avoid using the email argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Special Elements Injection
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Sourcecodester Open Source Clinic Management System