Undisclosed CVEable Vulnerabilities — HMS Corpus

Defensive/educational research. These are vulnerabilities found in the shipped source of four throwaway PHP demo HMS apps that have no corresponding issued CVE. Reported at class + file:line + sink level; no weaponized PoCs. Candidate IDs are local tracking labels, not assigned CVEs.

CWE legend: SQLi = CWE-89 · XSS = CWE-79 · CSRF = CWE-352 · IDOR/missing authz = CWE-639 / CWE-862 · unrestricted upload = CWE-434 · cleartext creds = CWE-256.


PHPGurukul HMS (root: hms/)

# file:line Class (CWE) Param / sink Why CVEable (no existing CVE)
PG-01admin/change-password.php:20SQLi (89)npass (POST)Second injectable param in the same query; the issued CVE-2024-0362 covers only cpass.
PG-02reset-password.php:11 + doctor/reset-password.php:11SQLi (89)newpassword via session name/emailUnauth password-reset flow concatenates attacker-stored input; no CVE.
PG-03doctor/forgot-password.php:9 + doctor/index.php:9SQLi (89)contactno/email, usernameDoctor-portal login & forgot mirror the patient pages (which got CVEs); doctor copies have none.
PG-04appointment-history.php:10 + doctor/appointment-history.php:11SQLi + IDOR (89/639)id (GET)UPDATE … WHERE id=$_GET[id] with no ownership check — cancel/alter any appointment.
PG-05admin/check_availability.php:6 + doctor/check_availability.php:5SQLi unauth (89)emailid/emailSame class as CVE-2020-22164 but the admin/doctor copies are unissued.
PG-06admin/contact.php:17SQLi (89)pagetitle, pagedes, emailThree more params in the same query; only mobnum got CVE-2024-0361.
PG-07doctor/edit-profile.php:16SQLi (89)fname/docfees/…Profile-update concatenation; patient edit-profile got 2020-22173, doctor copy unissued.
PG-08~10 admin listing pages (manage-patient.php:80, manage-doctors.php, user-logs.php, doctor-logs.php, read-query.php, unread-queries.php, manage-medhistory.php)Stored XSS (79)raw echo $row[...]Attacker-controllable DB fields rendered without htmlspecialchars; only a few pages are CVE'd.
PG-09App-wide (every state-changing form)CSRF (352)no token anywhereOnly add-doctor.php got a CSRF CVE (2025-70062); all other forms equally forgeable.

itsourcecode HMS (root: HMS/)

# file:line Class (CWE) Param / sink Why CVEable
IT-01adminlogin.php:41, doctorlogin.php:16, patientlogin.php:17SQLi → Auth Bypass (89/287)loginid, password (POST)Pre-auth login query concatenated; ' OR '1'='1 logs in. No login-page CVE exists.
IT-02treatmentrecord.php:7Unrestricted upload → RCE (434)$_FILES[uploads]move_uploaded_fileNo extension/MIME/content check, web-served dir — PHP webshell upload. Highest severity in corpus.
IT-03treatmentrecord.php:11,23,40,47SQLi + state-change-via-GET (89/352)editid/delid/patientid/appidMultiple injectable params + GET-driven DELETE, no session/CSRF check.
IT-04treatmentrecord.php:69,74,178, patientdetail.php:144, billing.php:46XSS reflected/stored (79)raw echo $_GET[...] / DB valuesOnly billing.php's instance is CVE'd; identical pattern elsewhere unissued.
IT-05patient.php:8, patientprofile.php:6SQLi (89)admissiontme + ~13 fields, editidReal home of the misnamed CVE-2026-11514 (which cited a non-existent file).
IT-06~45 other root PHP files (medicine.php, room.php, prescription.php, payment.php, orders.php, viewpatient.php, adminchangepassword.php, …)SQLi + broken access control (89/862)editid/delid/select/loginidSame defect in ~57 files; only 14 received CVEs; admin guards inconsistent/absent.

SourceCodester "Free HMS for Small Practices" (Vaidya Mitra) (root: vm/)

# file:line Class (CWE) Param / sink Why CVEable
SC-01admin/delete-doctor.php:18SQLi + broken auth (89/862)$_GET[id]id concatenated unquoted; auth guard lacks exit, runs unauthenticated.
SC-02admin/add-new.php:55SQLi (89)email/name/nic/Tele/specCreate-doctor endpoint; all POST values concatenated.
SC-03admin/edit-doc.php:44SQLi (89)email/name/nic/Tele/spec/id00Admin twin of the CVE'd doctor/edit-doc.php; never issued.
SC-04admin/add-session.php:23SQLi (89)docid/title/date/time/nopAll POST values into INSERT.
SC-05admin/delete-session.php:21 + doctor/delete-session.php:21SQLi + IDOR (89/639)$_GET[id]DELETE … scheduleid='$id'; guards lack exit.
SC-06admin/delete-appointment.php:21 + doctor/… + patient/…SQLi + IDOR (89/639)$_GET[id]Any user deletes any appointment; patient copy checks wrong role and lacks exit.
SC-07admin/appointment.php:292 + doctor/appointment.php:285SQLi (89)sheduledate, docidAdmin/doctor filters concatenate POST; only the patient copy is CVE'd.
SC-08admin/doctors.php + doctor/doctors.php (~:446/:688)SQLi + XSS (89/79)$_GET[id], $_GET[name]; unescaped DB echodoctor/doctors.php auth check commented out (line 41) — fully unauthenticated.
SC-09doctor/settings.php:431Stored XSS (79)name/emailvalue='.$name.'Self-edit form renders attacker-stored name unescaped (same root cause as CVE-2024-11102, different file).
SC-10doctor/appointment.php:56SQLi second-order (89)$useremail (session)Session email set from unsanitized login input, used in WHERE.
SC-11App-wideCSRF (352)GET-based deletes, no tokendelete-doctor.php?id= etc. directly forgeable.
SC-12App-wide (28 files)Broken access control (862)header("location:login.php") without exitAll admin/doctor mutations execute regardless of session — systemic root cause.

code-projects HMS (Fabian Ros) (root: hms/)

# file:line Class (CWE) Param / sink Why CVEable
CP-01doctor/index.php:6SQLi → Auth Bypass (89/287)username (docEmail=)Doctor login concatenated; same class as patient/admin logins, no doctor-portal CVE.
CP-02registration.php:11 (+admin/doctor copies)SQLi (89)full_name/address/city/gender/emailUnauthenticated stored INSERT, all fields concatenated.
CP-03book-appointment.php:20SQLi (89)Doctorspecialization/doctor/fees/appdate/apptimeAuthenticated patient input into INSERT.
CP-04edit-profile.php:14SQLi (89)fname/address/city/genderProfile UPDATE concatenated, any patient.
CP-05admin/edit-doctor-specialization.php:12SQLi (89)doctorspecilizationOnly the add page got CVE-2025-3206.
CP-06admin/edit-doctor.php:16SQLi (89)docname/clinicaddress/docfees/doccontactOnly add-doctor got CVE-2024-10350.
CP-07doctor/edit-profile.php:14SQLi (89)docname etc.Doctor self-edit UPDATE concatenated.
CP-08get_doctor.php:20SQLi (89)doctordocFeesSecond sink in the file; CVE-2024-10170 cites only specilizationid (line 6).
CP-09getfee.php:10SQLi unauth (89)docinfo (unquoted)?action=doctorid; numeric-context injection, unauthenticated.
CP-10admin/doctor-specilization.php:15, admin/manage-doctors.php:11, admin/manage-users.php:10SQLi + IDOR (89/639)$_GET[id] → DELETEGET-driven deletes with concatenated id (also CSRF).
CP-11appointment-history.php:9 + doctor/appointment-history.php:9SQLi + IDOR (89/639)$_GET[id] → UPDATE statusAny logged-in user cancels any appointment by id; no ownership check.
CP-12admin/change-password.php:11,15SQLi (89)cpass/npass (NOT md5-wrapped)Genuinely injectable, unlike the user page that got the weak CVE-2024-10169.
CP-13manage-users.php:100, manage-doctors.php:97, doctor-specilization.php:139, appointment-history.php:94Stored XSS (79)echo $row[...] w/o htmlentitiesOnly the doctor-name instance got CVE-2024-12983.
CP-14App-wideCSRF (352)no token anywhereGET-based delete/cancel links directly forgeable.
CP-15admin/index.php:7Cleartext credentials (256)admin password stored/compared in plaintextUnlike users/doctors (md5); discrete weakness, uncovered.

Totals

Source Line-item findings
PHPGurukul9
itsourcecode6
SourceCodester12
code-projects15
Total line items42

These 42 line items represent ~36 distinct root-cause issues (several rows are multi-file mass-instances). At one-CVE-per-file/parameter granularity (how these CNAs file) the count is 150–300+.


Appendix — explicit per-file enumerations (mass-instance groups)

Heuristic candidate lists from static patterns; entries marked are notable. SQLi = a variable interpolated into a query call + request input present in the file. Broken-auth = a session-guard header(location) redirect not followed by exit/die (public login/landing pages excluded). XSS = raw echo of DB row or request value.

PHPGurukul (root: hms/)

SQLi candidate files (39):

Broken-access-control — redirect w/o exit (35):

Stored/Reflected XSS sink files (26):

itsourcecode (root: HMS/)

SQLi candidate files (60):

Broken-access-control — redirect w/o exit (1):

Stored/Reflected XSS sink files (17):

SourceCodester (root: vm/)

SQLi candidate files (29):

Broken-access-control — redirect w/o exit (28):

Stored/Reflected XSS sink files (2):

code-projects (root: hms/)

SQLi candidate files (23):

Broken-access-control — redirect w/o exit (1):

Stored/Reflected XSS sink files (11):