The patient login endpoint in cover.php concatenates the submitted username and password directly into a SQL query. An unauthenticated attacker can bypass login with a boolean SQL injection payload and obtain an authenticated patient session.
Commit: f427b4757128ca253d33d0cc4e87bbb9c999a4d5
SQL Injection / Authentication Bypass
User-controlled credentials are placed directly into the SQL string. No prepared statement, escaping, or allow-list is used, so the attacker can break out of the string literal and alter the WHERE clause.
Deploy the application and set the target host.
Send a login request with invalid credentials and observe the absence of the Refresh header (login rejected).
Send the same request with a boolean SQL injection payload as the username.
The Refresh: url=ulogin.php response confirms the authentication bypass and that a patient session was created.
An unauthenticated attacker can log in as an arbitrary patient by making the query always match a row. The resulting session can be used to book, cancel, and view appointments belonging to other patients, and the same injection primitive can be used to exfiltrate database contents.
Please evaluate and assign a CVSS v3.1 score for this vulnerability.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
