PT-2026-27284 · Sourcecodester · Patients Waiting Area Queue Management System

Abhiram T · Published 2026-03-24 · Updated 2026-03-25 · CVE-2026-4617

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SourceCodester Patients Waiting Area Queue Management System version 1.0

Description A flaw exists in the Patient Check-In Module of the software, specifically within the ValidateToken function located in the /php/api patient checkin.php file. This can result in improper authorization, allowing remote attacks. The exploit for this issue is publicly available.

Recommendations Apply any available updates to address the improper authorization issue in the ValidateToken function of the /php/api patient checkin.php file. As a temporary workaround, consider restricting access to the Patient Check-In Module to minimize the risk of exploitation.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2026-4617

Affected Products

Patients Waiting Area Queue Management System

References · 9

• 🔥 https://gist.github.com/HxH404/0ab53ccba44456b5400a5908414f5ab1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4617 · Security Note
• https://twitter.com/cyberbivash/status/2036263020641255683 · Twitter Post
• https://vuldb.com/?ctiid.352481 · Note
• https://vuldb.com/?id.352481 · Note
• https://vuldb.com/?submit.775747 · Note
• https://twitter.com/RedPacketSec/status/2036319788654354781 · Twitter Post
• https://twitter.com/CVEarity/status/2036848629017878592 · Twitter Post
• https://sourcecodester.com · Note