PT-2025-38277 · Itsourcecode · Itsourcecode Online Clinic Management System

Drewbyte · Published 2025-09-17 · Updated 2025-09-18 · CVE-2025-10618

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions itsourcecode Online Clinic Management System version 1.0

Description A security issue exists in itsourcecode Online Clinic Management System 1.0 related to the transact.php file. Manipulation of the firstname parameter can lead to SQL injection, potentially allowing for remote attacks. The exploit for this issue has been publicly disclosed. Other parameters may also be affected.

Recommendations As a temporary workaround, consider restricting access to the transact.php file until a fix is available. Avoid using the firstname parameter in the affected file until the issue is resolved.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-10618

Affected Products

Itsourcecode Online Clinic Management System

References · 10

• 🔥 https://github.com/drew-byte/Online-Clinic-Management-System_TimeBasedSQLi_PoC/blob/main/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-10618 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10618 · Security Note
• https://twitter.com/VulmonFeeds/status/1968462314400514415 · Twitter Post
• https://itsourcecode.com · Note
• https://t.me/cveNotify/135809 · Telegram Post
• https://vuldb.com/?ctiid.324645 · Note
• https://vuldb.com/?id.324645 · Note
• https://vuldb.com/?submit.650177 · Note
• https://twitter.com/CVEnew/status/1968561170115080531 · Twitter Post