CVE-2026-90805: Online Clinic Management System SQLI Flaw

CVE-2026-90805 Overview

CVE-2026-90805 is a SQL injection vulnerability in the subhajitkhan online-clinic-management-system project, affecting code up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578. The flaw resides in doctorlogin.php, where the doc_mail and doc_pswd parameters are passed to a database query without proper sanitization. A remote, unauthenticated attacker can manipulate these arguments to inject arbitrary SQL. A public exploit exists, and the project maintainer had not responded to the issue report at the time of disclosure. Because the project uses a rolling release model, no fixed version identifier is available.

Critical Impact
Unauthenticated remote attackers can inject SQL through the doctor login endpoint, potentially reading, modifying, or bypassing authentication against the clinic database.

Affected Products

subhajitkhan online-clinic-management-system (rolling release)
Codebase up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578
Vulnerable component: doctorlogin.php

Discovery Timeline

2026-09-14 - CVE-2026-90805 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90805

Vulnerability Analysis

The vulnerability is a SQL injection flaw classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The doctorlogin.php script accepts the doc_mail and doc_pswd request parameters and incorporates them into a SQL query without parameterization or input validation. An attacker can supply crafted values that break out of the intended string context and alter the query logic.

Exploitation requires no authentication and no user interaction. The attack is delivered over the network against any exposed instance of the application. Because a public exploit has been published, opportunistic scanning and mass exploitation against internet-facing instances are plausible.

Root Cause

The root cause is direct concatenation of user-controlled HTTP parameters into a SQL statement executed against the clinic database. The application does not use prepared statements, does not bind parameters, and does not enforce type or length validation on the doc_mail and doc_pswd inputs before they reach the database driver.

Attack Vector

An attacker submits a POST or GET request to doctorlogin.php with malicious SQL payloads inside the doc_mail or doc_pswd fields. Typical payloads terminate the string literal and append conditions such as tautologies to bypass authentication, or use UNION SELECT clauses to extract data from other tables. Refer to the VulDB entry for CVE-2026-90805 and the GitHub issue tracker for technical details of the published proof of concept.

Detection Methods for CVE-2026-90805

Indicators of Compromise

HTTP requests to /doctorlogin.php containing SQL metacharacters such as single quotes, --, #, /*, or UNION keywords in doc_mail or doc_pswd parameters.
Web server access logs showing repeated failed login attempts against doctorlogin.php from a single source with variable payload lengths.
Unexpected database errors, mysql_error messages, or HTTP 500 responses tied to the doctor login flow.
Unusual outbound data volume from the database host following requests to the login endpoint.

Detection Strategies

Deploy web application firewall rules that inspect doc_mail and doc_pswd parameters for SQL injection signatures.
Enable database query logging and alert on syntactically malformed queries or queries containing UNION SELECT from the web application user.
Correlate authentication failures at doctorlogin.php with subsequent successful logins from the same source IP to identify authentication bypass.

Monitoring Recommendations

Monitor HTTP request bodies and query strings to doctorlogin.php for injection patterns and unusually long parameter values.
Track database process activity for anomalous SELECT statements against user or credential tables originating from the web tier.
Alert on new administrator or doctor accounts appearing in the database outside of change windows.

How to Mitigate CVE-2026-90805

Immediate Actions Required

Take internet-facing instances of the online-clinic-management-system offline or restrict access to trusted networks until a fix is applied.
Apply a web application firewall rule that blocks SQL metacharacters in the doc_mail and doc_pswd parameters submitted to doctorlogin.php.
Rotate all doctor and administrator credentials and audit the database for unauthorized accounts or record modifications.

Patch Information

No vendor patch is available. The project uses a rolling release model, and the maintainer had not responded to the issue report at the time of publication. Track the GitHub project repository and the associated issue for updates.

Workarounds

Modify doctorlogin.php locally to use prepared statements with bound parameters (for example, PDO or mysqli parameterized queries) instead of string concatenation.
Enforce server-side input validation that rejects non-email characters in doc_mail and constrains doc_pswd length and character set.
Place the application behind an authenticating reverse proxy or VPN to eliminate unauthenticated network exposure.
Run the database account used by the application with least privilege, removing DROP, ALTER, and cross-database SELECT rights.

bash

# Example ModSecurity rule to block SQLi patterns on the doctor login endpoint
SecRule REQUEST_URI "@endsWith /doctorlogin.php" \
    "id:1029085,phase:2,deny,status:403,log,\
     chain,msg:'Possible SQLi against doctorlogin.php (CVE-2026-90805)'"
    SecRule ARGS:doc_mail|ARGS:doc_pswd \
        "@rx (?i)(union(\s|/\*.*\*/)+select|'\s*or\s*'?1'?='?1|--|#|/\*)"