---
id: "CVE-2026-112139"
kind: "vulnerability"
aliases: ["CVE-2026-112139"]
title: "Online clinic management system: SQL injection in admin document handler"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["healthcare", "other", "php", "self-hosted"]
not_affected_if: ["admin-area-not-internet-exposed"]
published_at: "2026-10-19T12:17:01+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:23:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112139", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Online clinic management system: SQL injection in admin document handler

An unpatched PHP web application for clinic management has an SQL injection flaw in admindocview.php, reachable through the docid parameter. A remote attacker can read or change the application's database without logging in if the sources' exposure claims hold.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for admindocview.php in the deployed application and check whether it passes the `docid` parameter directly into a SQL query
- unknown for version checks, since the project uses a rolling release and the sources give no fixed version

## Fix

- No patch is confirmed by the sources; the project has not responded to the report
- Restrict access to the admin area or remove admindocview.php until the query is parameterised, and review the code for a fix

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112139

## From the sources

A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler. The manipulation of the argument docid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_