CVE-2026-109524
Received Received - Intake

Authorization Bypass in Online Appointment Booking System

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109524
EUVD
EUVD-2026-98737

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
girishsaraf Online-Appointment-Booking-System f427b4757128ca253d33d0cc4e87bbb9c999a4d5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Online Appointment Booking System where admin pages like Admin/showdoctor.php lack proper authorization checks. Unauthenticated users can access sensitive records by directly requesting these pages without a valid session. The issue occurs because these files do not include session_start() or role verification, allowing attackers to read confidential data such as doctor, clinic, and manager details.

Detection Guidance

Check if unauthenticated access is possible to admin pages like Admin/showdoctor.php by attempting to access them directly via browser or tools like curl. Example: curl -v http://target/Admin/showdoctor.php. If the page loads without authentication, the vulnerability exists.

Impact Analysis

An attacker could exploit this to access sensitive administrative data without authentication. This includes viewing doctor, clinic, and manager records, potentially leading to data breaches, unauthorized modifications, or further exploitation of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to personal and sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately restrict access to admin pages by implementing authentication checks. Add session_start() and role verification to Admin/showdoctor.php and related files. Temporarily block external access to admin directories via firewall rules until patches are applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109524. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart