{"id":"CVE-2026-112139","kind":"vulnerability","aliases":["CVE-2026-112139"],"related":[],"title":"Online clinic management system: SQL injection in admin document handler","description":"A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler. The manipulation of the argument docid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.","summary":"An unpatched PHP web application for clinic management has an SQL injection flaw in admindocview.php, reachable through the docid parameter. A remote attacker can read or change the application's database without logging in if the sources' exposure claims hold.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","other","php","self-hosted"],"not_affected_if":["admin-area-not-internet-exposed"],"how_to_check":"- Look for admindocview.php in the deployed application and check whether it passes the `docid` parameter directly into a SQL query\n- unknown for version checks, since the project uses a rolling release and the sources give no fixed version","fix":"- No patch is confirmed by the sources; the project has not responded to the report\n- Restrict access to the admin area or remove admindocview.php until the query is parameterised, and review the code for a fix","status":"open","published_at":"2026-10-19T12:17:01+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:23:10+00:00","updated_at":"2026-10-25T03:23:10+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:23:10Z","model":"claude-haiku-5-5","output":{"fix":"- No patch is confirmed by the sources; the project has not responded to the report\n- Restrict access to the admin area or remove admindocview.php until the query is parameterised, and review the code for a fix","reach":"internet","title":"Online clinic management system: SQL injection in admin document handler","impact":"high","summary":"An unpatched PHP web application for clinic management has an SQL injection flaw in admindocview.php, reachable through the docid parameter. A remote attacker can read or change the application's database without logging in if the sources' exposure claims hold.","category":"other","nicknames":[],"who_cares":["php","self-hosted","healthcare"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or alters patient records through SQL injection in the database","analyst_note":"Confirm whether admindocview.php requires an admin login and whether any fixed version exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112139 and the upstream repository.","how_to_check":"- Look for admindocview.php in the deployed application and check whether it passes the `docid` parameter directly into a SQL query\n- unknown for version checks, since the project uses a rolling release and the sources give no fixed version","needs_analyst":true,"not_affected_if":["admin-area-not-internet-exposed"],"who_is_affected":"Anyone running this clinic management system from the subhajitkhan repository up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 is exposed, especially if the admin pages are reachable from the internet. Teams using other clinic software, or a copy that has changed the admin document handler, can likely skip it, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000653,"input_tokens":3408,"output_tokens":625,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112139':13A,16A '-2026':12A,15A 'admin':8A 'admindocview.php':37B,86C 'administr':90C 'affect':79C,139C 'applic':27B,51B 'argument':97C 'attack':45B,104C 'avail':145C 'chang':49B 'claim':61B 'clinic':2A,29B,72C 'compon':89C 'continu':130C 'cve':11A,14A 'databas':53B 'deliv':129C 'disclos':113C 'docid':41B,98C 'document':9A 'e9ee77a8827a1446220fa07ee693dc4d9a29a578':77C 'earli':153C 'exploit':110C 'exposur':60B 'file':85C 'flaw':35B 'found':67C 'function':82C 'handler':10A,92C 'healthcar':17B 'hold':62B 'host':22B 'inform':137C,149C 'initi':107C 'inject':6A,34B,102C 'issu':156C 'lead':99C 'log':55B 'manag':3A,30B,73C 'manipul':94C 'may':105C,118C 'model':127C 'mutat':91C 'onlin':1A,71C 'online-clinic-management-system':70C 'paramet':42B 'php':19B,25B 'problem':152C 'product':122C 'project':147C 'public':116C 'reachabl':38B 'read':47B 'releas':126C,142C 'remot':44B,108C 'report':157C 'respond':161C 'result':134C 'roll':125C 'self':21B 'self-host':20B 'sourc':59B 'specif':135C 'sql':5A,33B,101C 'subhajitkhan':69C 'system':4A,74C 'unknown':81C 'unpatch':24B 'updat':131C,141C 'use':120C,123C 'version':136C 'vulner':64C 'web':26B 'without':54B 'yet':162C","nicknames":[],"mitigations":[],"who_affected":"Anyone running this clinic management system from the subhajitkhan repository up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 is exposed, especially if the admin pages are reachable from the internet. Teams using other clinic software, or a copy that has changed the admin document handler, can likely skip it, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T12:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112139","severity":null,"published_at":"2026-10-19T12:17:01+00:00","modified_at":"2026-10-19T17:17:12+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}