## Summary
CVE-2026-90858 affects subhajitkhan/online-clinic-management-system and allows an attacker to bypass authorization by manipulating the adminmail argument. The issue impacts administrative endpoints and can be triggered remotely over the network; the exploit is published and may be used.
## Technical Details
The GitHub issue report indicates that administrative scripts do not enforce the presence or role of $_SESSION['adminmail'] and proceed with database queries/mutations even when no session cookie is provided.
Key affected code paths (per the issue report):
- adminappview.php:2-36 starts a session but never checks it; it lists all appointments and accepts cancellation.
- approve.php:2-13, disadd.php:2-13, and admindocview.php:2-30 have the same missing guard before mutations.
- adminfeedbackview.php:2-10 returns all feedback without a guard.
Reproduction approach (PoC methodology described):
- Do not send a cookie and directly request admin pages.
- Use curl to GET adminappview.php and POST to approve.php and adminappview.php with parameters like add=1&docid=2 and cancel=1&appid=1.
- The verified fixture showed patient name/phone disclosure and database changes (e.g., doctor status and appointment cancellation).
## Affected
- subhajitkhan/online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 (rolling release; no fixed version details provided).
- Affected files/endpoints: adminappview.php, approve.php, disadd.php, admindocview.php, adminfeedbackview.php.
## Impact
- Authorization bypass for administrative actions.
- Unauthenticated network users can read appointment and feedback data.
- Integrity/availability impact: attackers can approve/disable/remove doctors and cancel appointments.
- Patient data exposure (e.g., names and phone numbers) and operational disruption of clinic scheduling.
## Mitigation
1. Centralize and enforce an administrator-only guard before every administrative action; reject missing/invalid $_SESSION['adminmail'] before any data access.
2. Apply CSRF protection to all state-changing requests (e.g., approvals/disabling/cancellations).
3. Add server-side validation for admin-related parameters (e.g., adminmail) and ensure session role checks are consistent across all admin scripts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-285