CVE-2026-4617
Improper Authorization in SourceCodester Patient Check-In Module
Publication date: 2026-03-24
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sourcecodester | patients_waiting_area_queue_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in CVE-2026-4617 is an improper access control flaw in the SourceCodester Patients Waiting Area Queue Management System version 1.0. Specifically, the authentication function ValidateToken() in the Patient Check-In Module is implemented but never called before processing requests.
Because ValidateToken() is not invoked, unauthenticated remote attackers can access and interact with all endpoint handlers without providing any credentials or authorization headers.
This means attackers can perform actions like registering fake patients or checking in appointments without authentication, which should normally be restricted.
How can this vulnerability impact me? :
This vulnerability allows anonymous attackers to manipulate the patient queue system remotely without authentication.
- Attackers can flood the queue with fake entries, disrupting the management of real patients.
- Fake patient registrations can cause legitimate patients to be skipped or delayed.
- In hospital environments, this can lead to patient safety risks as staff cannot distinguish between legitimate and fake queue entries.
- The system can be overwhelmed with bogus queue entries, potentially causing denial of service.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to access the Patient Check-In Module endpoints without providing any authentication token and observing if the system allows unauthorized operations.'}, {'type': 'paragraph', 'content': 'For example, sending crafted POST requests to the /php/api_patient_checkin.php endpoint with required parameters but without an Authorization header can reveal if the system improperly permits access.'}, {'type': 'paragraph', 'content': 'A sample command using curl to test this would be:'}, {'type': 'list_item', 'content': 'curl -X POST https://[target]/php/api_patient_checkin.php -d "appointmentId=12345"'}, {'type': 'list_item', 'content': 'curl -X POST https://[target]/php/api_patient_checkin.php -d "type=walk-in&patientId=1&appointmentType=checkup&additionalinfo=info&termsAgreement=1"'}, {'type': 'paragraph', 'content': 'If these requests succeed and return a success response (HTTP 200) with queue numbers or confirmation without requiring authentication, it indicates the presence of the vulnerability.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to enforce authentication by invoking the ValidateToken() function at the start of every request handler in the /php/api_patient_checkin.php file.
Specifically, add a call to ValidateToken() in each handler that processes POST requests, such as those handling appointment check-ins, walk-in patient registrations, and queue updates.
- For example, insert the line $user_id = ValidateToken(); at the beginning of each handler function.
- This ensures that only authenticated users with valid JWT tokens can perform queue management operations.
Additionally, monitor and restrict access to the API endpoint to trusted users and consider implementing rate limiting to prevent abuse.