Researcher: independent security research Date: 2026-06-29
The four products covered here are free PHP tutorial/demo apps. As far as we can tell none of them runs real infrastructure, so this is educational. The point is to give each author enough to fix the code (or label it as a teaching sample) without shipping working exploits. No PoCs below.
All four apps already have CVEs for the same bug classes listed here, often in the same file or an adjacent copy of it. The items below are the ones nobody bothered to file. Where an existing CVE covers the same class, it's listed in the Precedent column so the author can see this isn't a judgment call.
The ~40 rows boil down to a few defects per app: queries built by string concatenation, output printed without escaping, auth checks that don't stop execution, no CSRF tokens, and in one case an upload with no validation. Fix the defect, not the 40 instances.
Source root: hms/. Contact: author via phpgurukul.com.
| # | File:line | CWE | Class | Sink / parameter | Precedent CVE |
|---|---|---|---|---|---|
| PG-01 | admin/change-password.php:20 | 89 | SQLi | npass (2nd param in the same query) | CVE-2024-0362 (cpass, same file) |
| PG-02 | reset-password.php:11, doctor/reset-password.php:11 | 89 | SQLi | session-stored name/email | CVE-2020-22166 (forgot-password.php) |
| PG-03 | doctor/forgot-password.php:9, doctor/index.php:9 | 89 | SQLi | contactno/email, username | CVE-2020-22165 (patient user-login.php) |
| PG-04 | appointment-history.php:10, doctor/appointment-history.php:11 | 89/639 | SQLi + IDOR | id (GET), no ownership check | CVE-2020-22169 (same file, id) |
| PG-05 | admin/check_availability.php:6, doctor/check_availability.php:5 | 89 | SQLi (unauth) | emailid/email | CVE-2020-22164 (root check_availability.php) |
| PG-06 | admin/contact.php:17 | 89 | SQLi | pagetitle,pagedes,email (same query as the CVE'd mobnum) | CVE-2024-0361 (admin/contact.php, mobnum) |
| PG-07 | doctor/edit-profile.php:16 | 89 | SQLi | profile fields | CVE-2020-22173 (edit-profile.php) |
| PG-08 | ~10 admin/doctor listing pages (manage-patient.php, manage-doctors.php, user-logs.php, doctor-logs.php, read-query.php, unread-queries.php, manage-medhistory.php, view-medhistory.php) | 79 | Stored XSS | echo $row[...] with no escaping | CVE-2022-42206, CVE-2024-56990 |
| PG-09 | every state-changing form | 352 | CSRF | no token | CVE-2025-70062 (Add Doctor) |
Source root: flat, root-level *.php. Contact: author via itsourcecode.com.
| # | File:line | CWE | Class | Sink / parameter | Precedent CVE |
|---|---|---|---|---|---|
| IT-01 | adminlogin.php:41, doctorlogin.php:16, patientlogin.php:17 | 89/287 | SQLi auth bypass | loginid/password in the login SELECT | the 14 issued itsourcecode SQLi CVEs (e.g. CVE-2026-13497) |
| IT-02 | treatmentrecord.php:7 | 434 | Unrestricted upload (RCE) | $_FILES[uploads] to move_uploaded_file, no checks | none — fix this one first |
| IT-03 | treatmentrecord.php:11,23,40,47 | 89/352 | SQLi + state change over GET | editid/delid/patientid/appid | CVE-2026-13530 (appointmentdetail.php, editid) |
| IT-04 | treatmentrecord.php:69,74,178, patientdetail.php:144 | 79 | XSS | GET/DB values echoed raw | CVE-2026-11512 (billing.php) |
| IT-05 | patient.php:8, patientprofile.php:6 | 89 | SQLi | admissiontme + fields, editid | CVE-2026-11514 (filed against a file that doesn't exist; this is the real location) |
| IT-06 | ~46 more root files (full list in HMS_UNDISCLOSED_CVES.md) | 89 | SQLi | editid/delid etc. concatenated | the 14 issued SQLi CVEs |
itsourcecode has no admin/ folder; admin pages sit at the root. CVE-2026-13495 (adminprofile.php) is a valid precedent. CVE-2026-11513 (adminaccount.php, "Date") points at a sink that isn't there.
Codename Vaidya Mitra, app folder /vm/. Source root: vm/. Contact: author mayuri_k via SourceCodester.
| # | File:line | CWE | Class | Sink / parameter | Precedent CVE |
|---|---|---|---|---|---|
| SC-01 | admin/delete-doctor.php:18 | 89/862 | SQLi + broken auth | $_GET[id], guard has no exit | CVE-2023-4181 (same file) |
| SC-02 | admin/add-new.php:55 | 89 | SQLi | email/name/nic/Tele/spec | CVE-2023-4443 (doctor/edit-doc.php) |
| SC-03 | admin/edit-doc.php:44 | 89 | SQLi | doctor fields (admin copy) | CVE-2023-4443 (doctor/edit-doc.php) |
| SC-04 | admin/add-session.php:23 | 89 | SQLi | docid/title/date/time/nop | CVE-2023-4440 (appointment.php) |
| SC-05 | admin/delete-session.php:21, doctor/delete-session.php:21 | 89/639 | SQLi + IDOR | $_GET[id] | CVE-2023-4181 |
| SC-06 | admin/delete-appointment.php:21 (+ doctor, + patient) | 89/639 | SQLi + IDOR | $_GET[id], wrong role check, no exit | CVE-2024-11073 (patient/delete-account.php) |
| SC-07 | admin/appointment.php:292, doctor/appointment.php:285 | 89 | SQLi | sheduledate/docid | CVE-2023-4440/4441 (patient appointment.php) |
| SC-08 | admin/doctors.php, doctor/doctors.php (~:446/:688) | 89/79 | SQLi + XSS | $_GET[id]/$_GET[name]; auth check commented out | CVE-2023-5587 (admin/doctors.php, search) |
| SC-09 | doctor/settings.php:431 | 79 | Stored XSS | name/email into value='.$name.' | CVE-2024-11102 (doctor/edit-doc.php) |
| SC-10 | doctor/appointment.php:56 | 89 | SQLi (second order) | $useremail from session | CVE-2023-4180 (login.php) |
| SC-11 | GET-based deletes app-wide | 352 | CSRF | no token | none |
| SC-12 | 27 protected pages (full list in HMS_UNDISCLOSED_CVES.md) | 862 | Broken access control | header(location) with no exit | CVE-2023-4181, CVE-2024-11073 |
Author "Fabian Ros". Source root: hospital/hms/. Uses the old mysql_* API.
| # | File:line | CWE | Class | Sink / parameter | Precedent CVE |
|---|---|---|---|---|---|
| CP-01 | doctor/index.php:6 | 89/287 | SQLi auth bypass | username (docEmail=) | CVE-2024-12969 (admin/index.php), CVE-2024-8569 (user-login.php) |
| CP-02 | registration.php:11 (+ admin/doctor copies) | 89 | SQLi | full_name/address/city/gender/email | CVE-2024-10350 (admin/add-doctor.php) |
| CP-03 | book-appointment.php:20 | 89 | SQLi | appointment fields | CVE-2024-8944 (check_availability.php) |
| CP-04 | edit-profile.php:14 | 89 | SQLi | profile UPDATE fields | CVE-2025-3206 |
| CP-05 | admin/edit-doctor-specialization.php:12 | 89 | SQLi | doctorspecilization (edit page; CVE covers the add page) | CVE-2025-3206 (admin/doctor-specilization.php) |
| CP-06 | admin/edit-doctor.php:16 | 89 | SQLi | docname/docfees etc. (edit; CVE covers add) | CVE-2024-10350 (admin/add-doctor.php) |
| CP-07 | doctor/edit-profile.php:14 | 89 | SQLi | doctor profile UPDATE | CVE-2024-10350 |
| CP-08 | get_doctor.php:20 | 89 | SQLi | doctor (second sink in the file) | CVE-2024-10170 (get_doctor.php, specilizationid) |
| CP-09 | getfee.php:10 | 89 | SQLi (unauth, unquoted) | docinfo | CVE-2024-8944 |
| CP-10 | admin/doctor-specilization.php:15, manage-doctors.php:11, manage-users.php:10 | 89/639 | SQLi + IDOR | $_GET[id] DELETE | CVE-2025-3206, CVE-2024-12983 |
| CP-11 | appointment-history.php:9, doctor/appointment-history.php:9 | 89/639 | SQLi + IDOR | $_GET[id] status UPDATE | CVE-2024-10350 |
| CP-12 | admin/change-password.php:11,15 | 89 | SQLi | cpass/npass, not md5-wrapped | CVE-2024-10169 (user change-password.php; that CVE isn't exploitable as filed, this one is) |
| CP-13 | manage-users.php:100, manage-doctors.php:97, doctor-specilization.php:139, appointment-history.php:94 | 79 | Stored XSS | echo $row[...] unescaped | CVE-2024-12983 (admin/manage-doctors.php) |
| CP-14 | app-wide | 352 | CSRF | no token, GET deletes | none |
| CP-15 | admin/index.php:7 | 256 | Plaintext credentials | admin password stored/compared as plaintext | none |
Same defects in every app, so the fixes are the same:
$_GET/$_POST/$_SESSION into a query string.htmlspecialchars($v, ENT_QUOTES, 'UTF-8') before printing, including inside HTML attributes.header("location: login.php") redirect, call exit;. Check the role, not just whether someone is logged in.WHERE id = ? AND userId = ?). Don't act on a raw request id.password_hash() and password_verify(), not plaintext or bare MD5.For demo projects the realistic fix is probably a "do not deploy, insecure by design" notice plus the changes above.
Full per-file lists are in HMS_UNDISCLOSED_CVES.md. A few existing CVEs look wrong and may be worth a correction request to the assigning CNA: CVE-2026-1550 points at a Django .py file, CVE-2025-11609 at a Node/express-session artifact, CVE-2026-11513 at a sink that isn't there (adminaccount.php takes no request input), CVE-2026-11514 at a file that isn't there (though its admissiontme SQLi is real and lives in patient.php:8 — a wrong-filename correction, not a withdrawal), CVE-2024-10169 isn't exploitable as written (its cpass is md5()-wrapped), and CVE-2023-4176 names a file that isn't in the codebase. Details in HMS_CVE_FARMING_AUDIT.md.
Timeline: findings compiled 2026-06-29. Vendor notification and public writeup TBD.
Updated 07/23/26 — Re-verified the flagged filings against source. CVE-2026-11514 clarified: it is a real admissiontme SQLi filed against a non-existent file (addpatient.php); the correct location is patient.php:8, so the appropriate action is a filename correction rather than a withdrawal. CVE-2026-11513 confirmed non-reproducible (adminaccount.php has no user input).