CVE-2026-10299
Description
An IDOR vulnerability in Online Hospital Management System 1.0's viewdoctortimings.php allows remote attackers to delete arbitrary doctor timing records.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
An IDOR vulnerability in Online Hospital Management System 1.0's viewdoctortimings.php allows remote attackers to delete arbitrary doctor timing records.
Vulnerability
An Insecure Direct Object Reference (IDOR) vulnerability exists in code-projects Online Hospital Management System version 1.0, specifically within the viewdoctortimings.php script. The script processes a delid parameter from the URL to delete doctor timing records but fails to perform ownership checks or session validation. This allows for the deletion of records belonging to other doctors, and potentially by unauthenticated users [2].
Exploitation
An attacker can exploit this vulnerability by manipulating the delid parameter in the URL of the viewdoctortimings.php script. By guessing or enumerating the delid value, an attacker can send a crafted request to delete arbitrary doctor timing records. This can be initiated remotely and may not require authentication, as session validation is absent [2].
Impact
Successful exploitation allows an attacker to delete doctor timing records belonging to other doctors. This could lead to disruption of services or unauthorized modification of scheduling information. The scope of the compromise is limited to the doctor timing records that can be accessed via the delid parameter [2].
Mitigation
As of the available references, a fixed version for this vulnerability has not been disclosed. Users are advised to consult the vendor for patch information. No workarounds or EOL status are mentioned in the provided references [1, 2].
AI Insight generated on Jun 2, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: =1.0
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The application fails to validate ownership of records before deletion, allowing unauthorized users to remove data."
Attack vector
An attacker can exploit this Insecure Direct Object Reference (IDOR) vulnerability by manipulating the `delid` parameter in the URL of the `viewdoctortimings.php` script [ref_id=1]. This allows a user, even one with low privileges or potentially unauthenticated, to delete doctor timing records belonging to other doctors [ref_id=1]. The script lacks ownership checks and session validation, enabling the deletion of arbitrary records by guessing or enumerating the `delid` value [ref_id=1].
Affected code
The vulnerability exists in the `viewdoctortimings.php` script, specifically in the code block that processes the `delid` GET parameter to delete records from the `doctor_timings` table [ref_id=1]. The code directly uses the `$_GET[delid]` value in a DELETE SQL statement without verifying the session or ownership of the record [ref_id=1].
What the fix does
The advisory recommends adding server-side ownership verification before executing the deletion query [ref_id=1]. This involves checking if the `doctorid` associated with the `doctor_timings_id` matches the currently logged-in user's session ID [ref_id=1]. Additionally, it suggests enforcing authentication on sensitive pages and using POST requests for state-changing operations like deletion to mitigate this vulnerability [ref_id=1].
Preconditions
- inputThe `delid` parameter must be present in the URL.
- authThe advisory notes that the endpoint may be reachable by unauthenticated users, but typically requires at least low-privileged access to trigger the deletion of another doctor's timings.
Reproduction
1. Log in with a legitimate doctor account (e.g., doctorid=5). 2. Navigate to `viewdoctortimings.php`. 3. Intercept the request using a proxy like Burp Suite when clicking the delete button for a record. 4. Record the `delid` value for that record. 5. Log in with a different doctor account (account2). 6. Change the `delid` value in the intercepted request to the value recorded in step 4. 7. Forward the modified request. 8. Verify that the record belonging to the first doctor has been deleted without authorization [ref_id=1].
Generated on Jun 1, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6News mentions
0No linked articles in our index yet.