CVE-2026-10299: Hospital Management System RCE Flaw

CVE-2026-10299 Overview

CVE-2026-10299 is an Insecure Direct Object Reference (IDOR) vulnerability in code-projects Online Hospital Management System 1.0. The flaw resides in the viewdoctortimings.php file, where the delid parameter is improperly validated before being used as a resource identifier. An authenticated remote attacker can manipulate the delid argument to reference resources belonging to other users or records. The weakness maps to CWE-99: Improper Control of Resource Identifiers. A public exploit description is available, increasing the likelihood of opportunistic abuse against exposed instances.

Critical Impact
Authenticated attackers can manipulate the delid parameter to access or modify doctor timing records they are not authorized to interact with, undermining data integrity in hospital workflows.

Affected Products

code-projects Online Hospital Management System 1.0
Component: viewdoctortimings.php
Vulnerable parameter: delid

Discovery Timeline

2026-06-01 - CVE-2026-10299 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10299

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference within the doctor timings management workflow of Online Hospital Management System 1.0. The viewdoctortimings.php script accepts a delid parameter from the request and uses it directly as a record identifier without verifying that the authenticated session owns or has rights to that resource. Because the application trusts client-supplied identifiers, an attacker can substitute arbitrary values to interact with records belonging to other accounts. The issue is categorized under CWE-99: Improper Control of Resource Identifiers (Resource Injection). Exploitation requires high privileges in the application but no user interaction, and the network attack vector makes remote abuse straightforward against internet-exposed deployments. Public technical details are available in the GitHub Vulnerability Report and the VulDB CVE-2026-10299 entry.

Root Cause

The root cause is missing authorization checks on the delid parameter inside viewdoctortimings.php. The script resolves the identifier to a backend record without confirming session ownership or role-based access. This pattern allows horizontal access to data outside the attacker's authorization scope.

Attack Vector

An authenticated user sends a crafted HTTP request to viewdoctortimings.php with a manipulated delid value referencing another record. The server processes the request using the supplied identifier, exposing or affecting data the user should not be able to reach. No social engineering or local access is required. Refer to the GitHub Vulnerability Report for parameter-level reproduction steps.

Detection Methods for CVE-2026-10299

Indicators of Compromise

Repeated HTTP requests to viewdoctortimings.php with sequentially incrementing or fuzzed delid values from a single session.
Application or database logs showing record accesses where the requesting user does not own the referenced doctor timing entry.
Unexpected deletions or views of doctor timing records correlated with a single authenticated session.

Detection Strategies

Inspect web server access logs for enumeration patterns against delid and other numeric identifiers in the viewdoctortimings.php endpoint.
Correlate authenticated session IDs with the resource IDs accessed and alert on mismatches between user ownership and accessed records.
Deploy a Web Application Firewall (WAF) rule to flag tampered identifier parameters and anomalous request rates against the affected script.

Monitoring Recommendations

Enable verbose application logging for all CRUD operations on doctor timing records, including the acting user and target record ID.
Monitor for spikes in 200-status responses to viewdoctortimings.php from accounts with limited expected activity.
Forward web and database logs to a centralized analytics platform for cross-session correlation and retention.

How to Mitigate CVE-2026-10299

Immediate Actions Required

Restrict network exposure of the Online Hospital Management System 1.0 deployment to trusted networks or behind VPN until a fix is applied.
Audit existing user accounts and revoke privileges that are not strictly required for clinical operations.
Review recent access logs for viewdoctortimings.php to identify any unauthorized record manipulation.

Patch Information

No vendor patch has been published in the referenced advisories at the time of disclosure. Track the VulDB CVE-2026-10299 entry and the Code Projects Resource page for updated builds. Operators maintaining the source locally should add a server-side authorization check that validates the requesting user's ownership of the record referenced by delid before any read or delete action.

Workarounds

Add a session-bound authorization check in viewdoctortimings.php that confirms the authenticated user owns the record referenced by delid before processing the request.
Replace direct numeric identifiers with indirect, per-session reference maps so client-supplied values cannot be enumerated.
Deploy WAF rules that block requests to viewdoctortimings.php when the delid parameter does not match values issued to the current session.

bash

# Example WAF rule (ModSecurity) to block tampered delid values
SecRule REQUEST_URI "@contains /viewdoctortimings.php" \
  "id:1029926,phase:2,deny,status:403,\
  chain,msg:'CVE-2026-10299 IDOR attempt on delid'"
  SecRule ARGS:delid "!@rx ^[0-9]{1,6}$" "t:none"