{"id":"CVE-2025-10618","state":"PUBLISHED","title":"itsourcecode Online Clinic Management System transact.php sql injection","description":"A security vulnerability has been detected in itsourcecode Online Clinic Management System 1.0. Affected by this issue is some unknown functionality of the file transact.php. Such manipulation of the argument firstname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Other parameters might be affected as well.","publishedAt":"2025-09-17T21:02:07.663Z","updatedAt":"2025-09-18T14:34:35.891Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["itsourcecode Online Clinic Management System"],"affected":[{"vendor":"itsourcecode","product":"Online Clinic Management System","versions":[{"version":"1.0","status":"affected"}]}],"references":["https://vuldb.com/?id.324645","https://vuldb.com/?ctiid.324645","https://vuldb.com/?submit.650177","https://github.com/drew-byte/Online-Clinic-Management-System_TimeBasedSQLi_PoC/blob/main/README.md","https://itsourcecode.com/"],"weaknesses":["CWE-89","CWE-74"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/10xxx/CVE-2025-10618.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-10618","state":"PUBLISHED","datePublished":"2025-09-17T21:02:07.663Z","dateUpdated":"2025-09-18T14:34:35.891Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-09-17T11:31:41.334Z"},"containers":{"cna":{"title":"itsourcecode Online Clinic Management System transact.php sql injection","descriptions":[{"lang":"en","value":"A security vulnerability has been detected in itsourcecode Online Clinic Management System 1.0. Affected by this issue is some unknown functionality of the file transact.php. Such manipulation of the argument firstname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Other parameters might be affected as well."},{"lang":"de","value":"Es wurde eine Schwachstelle in itsourcecode Online Clinic Management System 1.0 entdeckt. Betroffen ist eine unbekannte Funktion der Datei transact.php. Die Bearbeitung des Arguments firstname verursacht sql injection. Ein Angriff ist aus der Distanz möglich. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"itsourcecode","product":"Online Clinic Management System","versions":[{"version":"1.0","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.324645","name":"VDB-324645 | itsourcecode Online Clinic Management System transact.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.324645","name":"VDB-324645 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.650177","name":"Submit #650177 | itsourcecode Online Clinic Management System 1 Time-Based Blind SQL Injection in transact.php","tags":["third-party-advisory"]},{"url":"https://github.com/drew-byte/Online-Clinic-Management-System_TimeBasedSQLi_PoC/blob/main/README.md","tags":["exploit"]},{"url":"https://itsourcecode.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"SQL Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-09-17T21:02:07.663Z"},"timeline":[{"time":"2025-09-17T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-09-17T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-09-17T13:36:46.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"drewbyte (VulDB User)","type":"reporter"}],"tags":["x_freeware"]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/drew-byte/Online-Clinic-Management-System_TimeBasedSQLi_PoC/blob/main/README.md","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-18T14:34:32.554960Z","id":"CVE-2025-10618","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-18T14:34:35.891Z"}}]}}}