Defensive/educational research. These are vulnerabilities found in the shipped source of four throwaway PHP demo HMS apps that have no corresponding issued CVE. Reported at class + file:line + sink level; no weaponized PoCs. Candidate IDs are local tracking labels, not assigned CVEs.
CWE legend: SQLi = CWE-89 · XSS = CWE-79 · CSRF = CWE-352 · IDOR/missing authz = CWE-639 / CWE-862 · unrestricted upload = CWE-434 · cleartext creds = CWE-256.
hms/)| # | file:line | Class (CWE) | Param / sink | Why CVEable (no existing CVE) |
|---|---|---|---|---|
| PG-01 | admin/change-password.php:20 | SQLi (89) | npass (POST) | Second injectable param in the same query; the issued CVE-2024-0362 covers only cpass. |
| PG-02 | reset-password.php:11 + doctor/reset-password.php:11 | SQLi (89) | newpassword via session name/email | Unauth password-reset flow concatenates attacker-stored input; no CVE. |
| PG-03 | doctor/forgot-password.php:9 + doctor/index.php:9 | SQLi (89) | contactno/email, username | Doctor-portal login & forgot mirror the patient pages (which got CVEs); doctor copies have none. |
| PG-04 | appointment-history.php:10 + doctor/appointment-history.php:11 | SQLi + IDOR (89/639) | id (GET) | UPDATE … WHERE id=$_GET[id] with no ownership check — cancel/alter any appointment. |
| PG-05 | admin/check_availability.php:6 + doctor/check_availability.php:5 | SQLi unauth (89) | emailid/email | Same class as CVE-2020-22164 but the admin/doctor copies are unissued. |
| PG-06 | admin/contact.php:17 | SQLi (89) | pagetitle, pagedes, email | Three more params in the same query; only mobnum got CVE-2024-0361. |
| PG-07 | doctor/edit-profile.php:16 | SQLi (89) | fname/docfees/… | Profile-update concatenation; patient edit-profile got 2020-22173, doctor copy unissued. |
| PG-08 | ~10 admin listing pages (manage-patient.php:80, manage-doctors.php, user-logs.php, doctor-logs.php, read-query.php, unread-queries.php, manage-medhistory.php) | Stored XSS (79) | raw echo $row[...] | Attacker-controllable DB fields rendered without htmlspecialchars; only a few pages are CVE'd. |
| PG-09 | App-wide (every state-changing form) | CSRF (352) | no token anywhere | Only add-doctor.php got a CSRF CVE (2025-70062); all other forms equally forgeable. |
HMS/)| # | file:line | Class (CWE) | Param / sink | Why CVEable |
|---|---|---|---|---|
| IT-01 | adminlogin.php:41, doctorlogin.php:16, patientlogin.php:17 | SQLi → Auth Bypass (89/287) | loginid, password (POST) | Pre-auth login query concatenated; ' OR '1'='1 logs in. No login-page CVE exists. |
| IT-02 | treatmentrecord.php:7 | Unrestricted upload → RCE (434) | $_FILES[uploads] → move_uploaded_file | No extension/MIME/content check, web-served dir — PHP webshell upload. Highest severity in corpus. |
| IT-03 | treatmentrecord.php:11,23,40,47 | SQLi + state-change-via-GET (89/352) | editid/delid/patientid/appid | Multiple injectable params + GET-driven DELETE, no session/CSRF check. |
| IT-04 | treatmentrecord.php:69,74,178, patientdetail.php:144, billing.php:46 | XSS reflected/stored (79) | raw echo $_GET[...] / DB values | Only billing.php's instance is CVE'd; identical pattern elsewhere unissued. |
| IT-05 | patient.php:8, patientprofile.php:6 | SQLi (89) | admissiontme + ~13 fields, editid | Real home of the misnamed CVE-2026-11514 (which cited a non-existent file). |
| IT-06 | ~45 other root PHP files (medicine.php, room.php, prescription.php, payment.php, orders.php, viewpatient.php, adminchangepassword.php, …) | SQLi + broken access control (89/862) | editid/delid/select/loginid | Same defect in ~57 files; only 14 received CVEs; admin guards inconsistent/absent. |
vm/)| # | file:line | Class (CWE) | Param / sink | Why CVEable |
|---|---|---|---|---|
| SC-01 | admin/delete-doctor.php:18 | SQLi + broken auth (89/862) | $_GET[id] | id concatenated unquoted; auth guard lacks exit, runs unauthenticated. |
| SC-02 | admin/add-new.php:55 | SQLi (89) | email/name/nic/Tele/spec | Create-doctor endpoint; all POST values concatenated. |
| SC-03 | admin/edit-doc.php:44 | SQLi (89) | email/name/nic/Tele/spec/id00 | Admin twin of the CVE'd doctor/edit-doc.php; never issued. |
| SC-04 | admin/add-session.php:23 | SQLi (89) | docid/title/date/time/nop | All POST values into INSERT. |
| SC-05 | admin/delete-session.php:21 + doctor/delete-session.php:21 | SQLi + IDOR (89/639) | $_GET[id] | DELETE … scheduleid='$id'; guards lack exit. |
| SC-06 | admin/delete-appointment.php:21 + doctor/… + patient/… | SQLi + IDOR (89/639) | $_GET[id] | Any user deletes any appointment; patient copy checks wrong role and lacks exit. |
| SC-07 | admin/appointment.php:292 + doctor/appointment.php:285 | SQLi (89) | sheduledate, docid | Admin/doctor filters concatenate POST; only the patient copy is CVE'd. |
| SC-08 | admin/doctors.php + doctor/doctors.php (~:446/:688) | SQLi + XSS (89/79) | $_GET[id], $_GET[name]; unescaped DB echo | doctor/doctors.php auth check commented out (line 41) — fully unauthenticated. |
| SC-09 | doctor/settings.php:431 | Stored XSS (79) | name/email → value='.$name.' | Self-edit form renders attacker-stored name unescaped (same root cause as CVE-2024-11102, different file). |
| SC-10 | doctor/appointment.php:56 | SQLi second-order (89) | $useremail (session) | Session email set from unsanitized login input, used in WHERE. |
| SC-11 | App-wide | CSRF (352) | GET-based deletes, no token | delete-doctor.php?id= etc. directly forgeable. |
| SC-12 | App-wide (28 files) | Broken access control (862) | header("location:login.php") without exit | All admin/doctor mutations execute regardless of session — systemic root cause. |
hms/)| # | file:line | Class (CWE) | Param / sink | Why CVEable |
|---|---|---|---|---|
| CP-01 | doctor/index.php:6 | SQLi → Auth Bypass (89/287) | username (docEmail=) | Doctor login concatenated; same class as patient/admin logins, no doctor-portal CVE. |
| CP-02 | registration.php:11 (+admin/doctor copies) | SQLi (89) | full_name/address/city/gender/email | Unauthenticated stored INSERT, all fields concatenated. |
| CP-03 | book-appointment.php:20 | SQLi (89) | Doctorspecialization/doctor/fees/appdate/apptime | Authenticated patient input into INSERT. |
| CP-04 | edit-profile.php:14 | SQLi (89) | fname/address/city/gender | Profile UPDATE concatenated, any patient. |
| CP-05 | admin/edit-doctor-specialization.php:12 | SQLi (89) | doctorspecilization | Only the add page got CVE-2025-3206. |
| CP-06 | admin/edit-doctor.php:16 | SQLi (89) | docname/clinicaddress/docfees/doccontact | Only add-doctor got CVE-2024-10350. |
| CP-07 | doctor/edit-profile.php:14 | SQLi (89) | docname etc. | Doctor self-edit UPDATE concatenated. |
| CP-08 | get_doctor.php:20 | SQLi (89) | doctor → docFees | Second sink in the file; CVE-2024-10170 cites only specilizationid (line 6). |
| CP-09 | getfee.php:10 | SQLi unauth (89) | docinfo (unquoted) | ?action=doctorid; numeric-context injection, unauthenticated. |
| CP-10 | admin/doctor-specilization.php:15, admin/manage-doctors.php:11, admin/manage-users.php:10 | SQLi + IDOR (89/639) | $_GET[id] → DELETE | GET-driven deletes with concatenated id (also CSRF). |
| CP-11 | appointment-history.php:9 + doctor/appointment-history.php:9 | SQLi + IDOR (89/639) | $_GET[id] → UPDATE status | Any logged-in user cancels any appointment by id; no ownership check. |
| CP-12 | admin/change-password.php:11,15 | SQLi (89) | cpass/npass (NOT md5-wrapped) | Genuinely injectable, unlike the user page that got the weak CVE-2024-10169. |
| CP-13 | manage-users.php:100, manage-doctors.php:97, doctor-specilization.php:139, appointment-history.php:94 | Stored XSS (79) | echo $row[...] w/o htmlentities | Only the doctor-name instance got CVE-2024-12983. |
| CP-14 | App-wide | CSRF (352) | no token anywhere | GET-based delete/cancel links directly forgeable. |
| CP-15 | admin/index.php:7 | Cleartext credentials (256) | admin password stored/compared in plaintext | Unlike users/doctors (md5); discrete weakness, uncovered. |
| Source | Line-item findings |
|---|---|
| PHPGurukul | 9 |
| itsourcecode | 6 |
| SourceCodester | 12 |
| code-projects | 15 |
| Total line items | 42 |
These 42 line items represent ~36 distinct root-cause issues (several rows are multi-file mass-instances). At one-CVE-per-file/parameter granularity (how these CNAs file) the count is 150–300+.
Heuristic candidate lists from static patterns; entries marked are notable. SQLi = a variable interpolated into a query call + request input present in the file. Broken-auth = a session-guard header(location) redirect not followed by exit/die (public login/landing pages excluded). XSS = raw echo of DB row or request value.
hms/)SQLi candidate files (39):
admin/about-us.phpadmin/add-doctor.phpadmin/betweendates-detailsreports.phpadmin/change-password.phpadmin/check_availability.phpadmin/contact.phpadmin/doctor-specilization.phpadmin/edit-doctor-specialization.phpadmin/edit-doctor.phpadmin/index.phpadmin/manage-doctors.phpadmin/manage-users.phpadmin/patient-search.phpadmin/query-details.phpadmin/registration.phpadmin/view-patient.phpappointment-history.phpbook-appointment.phpchange-emaild.phpchange-password.phpcheck_availability.phpdoctor/add-patient.phpdoctor/appointment-history.phpdoctor/change-password.phpdoctor/check_availability.phpdoctor/edit-patient.phpdoctor/edit-profile.phpdoctor/forgot-password.phpdoctor/index.phpdoctor/reset-password.phpdoctor/search.phpdoctor/view-patient.phpedit-profile.phpforgot-password.phpget_doctor.phpregistration.phpreset-password.phpuser-login.phpview-medhistory.phpBroken-access-control — redirect w/o exit (35):
admin/about-us.phpadmin/add-doctor.phpadmin/appointment-history.phpadmin/between-dates-reports.phpadmin/betweendates-detailsreports.phpadmin/change-password.phpadmin/contact.phpadmin/dashboard.phpadmin/doctor-logs.phpadmin/doctor-specilization.phpadmin/edit-doctor-specialization.phpadmin/edit-doctor.phpadmin/manage-doctors.phpadmin/manage-patient.phpadmin/manage-users.phpadmin/patient-search.phpadmin/query-details.phpadmin/read-query.phpadmin/unread-queries.phpadmin/user-logs.phpadmin/view-patient.phpappointment-history.phpdoctor/add-patient.phpdoctor/appointment-history.phpdoctor/change-password.phpdoctor/dashboard.phpdoctor/edit-patient.phpdoctor/edit-profile.phpdoctor/forgot-password.phpdoctor/manage-patient.phpdoctor/search.phpdoctor/view-patient.phpforgot-password.phpregistration.phpuser-login.phpStored/Reflected XSS sink files (26):
admin/about-us.phpadmin/appointment-history.phpadmin/betweendates-detailsreports.phpadmin/contact.phpadmin/doctor-logs.phpadmin/doctor-specilization.phpadmin/edit-doctor-specialization.phpadmin/manage-doctors.phpadmin/manage-patient.phpadmin/manage-users.phpadmin/patient-search.phpadmin/query-details.phpadmin/read-query.phpadmin/unread-queries.phpadmin/user-logs.phpadmin/view-patient.phpappointment-history.phpdoctor/appointment-history.phpdoctor/edit-patient.phpdoctor/include/header.phpdoctor/manage-patient.phpdoctor/search.phpdoctor/view-patient.phpinclude/header.phpmanage-medhistory.phpview-medhistory.phpHMS/)SQLi candidate files (60):
Viewdepartment.phpadmin.phpadminchangepassword.phpadminlogin.phpadminprofile.phpajaxmedicine.phpappointment.phpappointmentapproval.phpappointmentdetail.phpdepartment.phpdepartmentDoctor.phpdoctor.phpdoctorchangepassword.phpdoctorlogin.phpdoctorprofile.phpdoctortimings.phpinsertbillingrecord.phpmedicine.phporders.phppatient.phppatient_profile.phppatientappointment.phppatientchangepassword.phppatientdetail.phppatientforgotpassword.phppatientlogin.phppatientorder.phppatientprofile.phppatientreport.phppatviewprescription.phppayment.phppaymentdischarge.phpprescription.phpprescriptiondetail.phpprescriptionorder.phpprescriptionorderdetail.phpprescriptionorderreport.phpprescriptionrecord.phproom.phpservicetype.phptreatment.phptreatmentdetail.phptreatmentrecord.phpviewadmin.phpviewappointment.phpviewappointmentapproved.phpviewappointmentpending.phpviewbilling.phpviewdoctor.phpviewdoctorconsultancycharge.phpviewdoctortimings.phpviewmedicine.phpviewpatient.phpviewpaymentreport.phpviewprescription.phpviewprescriptionrecord.phpviewroom.phpviewservicetype.phpviewtreatment.phpviewtreatmentrecord.phpBroken-access-control — redirect w/o exit (1):
patient_profile.phpStored/Reflected XSS sink files (17):
adminaccount.phpappointment.phpappointmentapproval.phpbilling.phpdoctoraccount.phppatientappointment.phppatientreport.phppayment.phppaymentdischarge.phpprescription.phpprescriptiondetail.phpprescriptionorder.phpprescriptionorderdetail.phpprescriptionorderreport.phpprescriptionrecord.phptreatmentdetail.phptreatmentrecord.phpvm/)SQLi candidate files (29):
admin/add-new.phpadmin/add-session.phpadmin/appointment.phpadmin/delete-appointment.phpadmin/delete-doctor.phpadmin/delete-session.phpadmin/doctors.phpadmin/edit-doc.phpadmin/patient.phpadmin/schedule.phpcreate-account.phpdoctor/appointment.phpdoctor/delete-appointment.phpdoctor/delete-session.phpdoctor/doctors.phpdoctor/edit-doc.phpdoctor/patient.phpdoctor/schedule.phpdoctor/settings.phplogin.phppatient/appointment.phppatient/booking-complete.phppatient/booking.phppatient/delete-appointment.phppatient/doctors.phppatient/edit-user.phppatient/patient.phppatient/schedule.phppatient/settings.phpBroken-access-control — redirect w/o exit (28):
admin/add-new.phpadmin/add-session.phpadmin/appointment.phpadmin/delete-appointment.phpadmin/delete-doctor.phpadmin/delete-session.phpadmin/doctors.phpadmin/edit-doc.phpadmin/patient.phpadmin/schedule.phpdoctor/appointment.phpdoctor/delete-appointment.phpdoctor/delete-session.phpdoctor/doctors.phpdoctor/edit-doc.phpdoctor/patient.phpdoctor/schedule.phpdoctor/settings.phppatient/appointment.phppatient/booking-complete.phppatient/booking.phppatient/delete-account.phppatient/delete-appointment.phppatient/doctors.phppatient/edit-user.phppatient/patient.phppatient/schedule.phppatient/settings.phpStored/Reflected XSS sink files (2):
patient/appointment.phppatient/schedule.phphms/)SQLi candidate files (23):
admin/add-doctor.phpadmin/change-password.phpadmin/check_availability.phpadmin/doctor-specilization.phpadmin/edit-doctor-specialization.phpadmin/edit-doctor.phpadmin/index.phpadmin/manage-doctors.phpadmin/manage-users.phpadmin/registration.phpappointment-history.phpbook-appointment.phpchange-password.phpcheck_availability.phpdoctor/appointment-history.phpdoctor/change-password.phpdoctor/edit-profile.phpdoctor/index.phpedit-profile.phpget_doctor.phpgetfee.phpregistration.phpuser-login.phpBroken-access-control — redirect w/o exit (1):
registration.phpStored/Reflected XSS sink files (11):
admin/appointment-history.phpadmin/doctor-logs.phpadmin/doctor-specilization.phpadmin/edit-doctor-specialization.phpadmin/manage-doctors.phpadmin/manage-users.phpadmin/user-logs.phpappointment-history.phpdoctor/appointment-history.phpdoctor/include/header.phpinclude/header.php