CVE-2026-78246 is a high severity (CVSS 7.3) SQL injection in itsourcecode Online Clinic Management System 1.0, in the admin login file success/login.php through the Username argument. The record says a public exploit exists. We found no vendor fix, so take the application off public networks.
What's affected
itsourcecode Online Clinic Management System version 1.0, in the file success/login.php of the Admin Login component. The record says remote exploitation is possible and that the exploit has been disclosed publicly.
We did not find a vendor advisory or a fixed version. The references are a GitHub issue, the vendor's home page and VulDB entries, and we did not fetch them. Treat the product as unpatched unless the vendor says otherwise. Projects of this type are often sample or student code, which is a poor fit for production data.
How to check if you're exposed
Search your web servers for the application. Look for a directory called success containing login.php, or the product name in page titles.
find /var/www -name login.php -path "*success*"
If you find it, check whether it is reachable from the internet and whether it holds real patient or staff data. Review database and web logs for unusual login attempts, such as very long or odd-looking username values.
What to do now
- Take the application off the public internet, or put it behind a VPN or an IP allowlist.
- If you need the system, plan a move to maintained software. We found no fixed version for this one.
- Review the code path that handles the login, replace string-built queries with parameterized queries, and add input validation if you must keep running it.
- Rotate administrator passwords and review the database for unexpected accounts or changes.
- Because this may hold health data, involve your privacy or compliance contact if you see signs of misuse.
Why it matters
This is CWE-89, SQL injection, with the broader CWE-74, injection, class in the record. The login form passes the Username value into a database query without treating it as plain data. An attacker who controls that value can change what the query does, which on a login page often means getting past authentication or reading the database.
The record notes the exploit is public, which shortens the time between disclosure and abuse. It does not say the flaw is exploited in the wild, and the KEV flag is false. The fix pattern is unglamorous and well known: parameterized queries everywhere user input meets the database.
Quick check
Is there a patch?
We could not confirm one. The record lists no fixed version, so plan on removing or replacing the application.
Why does a public exploit matter?
Anyone can use it without research, so unpatched exposed instances are easy targets.
Sources
- VulDB entry listed in the record (not fetched)
- Reporter's GitHub issue (listed in the record, not fetched)
Last reviewed: 18 October 2026.
