This vulnerability involves an SQL injection in the subhajitkhan online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578. The injection occurs through manipulation of the searchtext parameter in the listdoctor.php file. The vulnerability can be exploited remotely without authentication. The project has not yet responded or issued a fix. The product uses a rolling release model, preventing precise version identification of affected or patched releases. Public exploit code exists.

Successful exploitation allows remote attackers to inject SQL commands via the searchtext parameter, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

No official fix or patch is currently available as the vendor has not responded. Users should monitor the vendor's communications for updates. Until a fix is released, avoid exposing the vulnerable functionality to untrusted users or implement web application firewall rules to detect and block SQL injection attempts targeting the searchtext parameter.