edoc-doctor-appointment-system

edoc-doctor-appointment-system copied to clipboard

Found a vulnerability

1

patient/schedule.php include("../connection.php"); $sqlmain= "select * from patient where pemail=?"; $stmt = $database->prepare($sqlmain); $stmt->bind_param("s",$useremail); $stmt->execute(); $result = $stmt->get_result(); $userfetch=$userrow->fetch_assoc(); $userid= $userfetch["pid"]; $username=$userfetch["pname"];` Error: Warning: Undefined variable $userrow in /Applications/MAMP/htdocs/edoc/patient/schedule.php on line...

bacskaicsaba91

Connection failed

1

Hi, I have installed this repo but when I go to make appointment/login/register I obtain an error: Connection failed: Access denied for user 'root'@'localhost' Any solution?

malafalx91

`admin/add-new.php` from line 47, The $email parameter is controllable, the parameter email can be passed through post, and the $email is not protected from sql injection, line 54 `$result= $database->query("select...

KillerFr0st

Blind sql injection in login page

1

**page** : login.php ``` https://github.com/HashenUdara/edoc-echanneling/blob/main/login.php#L48 ``` **Http request** ``` POST /cve/php-edoc-echanneling-main/edoc-echanneling-main/login.php HTTP/1.1 Host: localhost Content-Length: 108 Cache-Control: max-age=0 sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="98" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: http://localhost Content-Type:...

az7rb

### Vulnerability file address `patient/delete-appointment.php` from line 3,the problem is at line 11 `header("location: ../login.php");`,there is no exit() termination statement after the header function in the else statement, so that...

0clickjacking0

### Vulnerability file address `doctor/patient.php` from line 26,the problem is at line 36`header("location: ../login.php");`,there is no exit() termination statement after the header function in the else statement, so that the...

0clickjacking0

### Vulnerability file address `patient/appointment.php` from line 54,The $sheduledate parameter is controllable, the parameter sheduledate can be passed through post, and the $sheduledate is not protected from sql injection, line...

0clickjacking0

### Vulnerability file address `patient/edit-user.php` from line 11,The $email parameter is controllable, the parameter email can be passed through post, and the $email is not protected from sql injection, line...

0clickjacking0

### Vulnerability file address `patient/schedule.php` from line 117,The $keyword parameter is controllable, the parameter search can be passed through post, and the $keyword is not protected from sql injection, line...

0clickjacking0

### Vulnerability file address `patient/booking-complete.php` from line 27,The $scheduleid parameter is controllable, the parameter scheduleid can be passed through post, and the $scheduleid is not protected from sql injection, line...

0clickjacking0