This vulnerability exists in the subhajitkhan online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578. The flaw is located in an unspecified part of doctorlogin.php where the doc_mail or doc_pswd parameters can be manipulated to perform SQL injection. The attack vector is remote and does not require privileges or user interaction. The product follows a rolling release model, so no fixed or affected versions are explicitly identified. The vendor has not responded to the issue report, and no patch or remediation is currently available. An exploit has been published, but there is no evidence of active exploitation in the wild.

Successful exploitation allows remote attackers to perform SQL injection via the doc_mail or doc_pswd parameters in doctorlogin.php. This could lead to unauthorized access to or manipulation of the backend database, potentially compromising sensitive data or system integrity. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has not responded or issued a fix. Until a patch is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the doc_mail and doc_pswd parameters. Monitoring for unusual database activity related to these parameters is also advisable.