CVE-2026-10299: Online Hospital Management System Resource Identifier Control Vulnerability

Technical summary

The vulnerability exists in the viewdoctortimings.php component of Online Hospital Management System 1.0 and stems from improper control of resource identifiers (CWE-99). The flaw allows an authenticated high-privileged user to supply arbitrary values to the 'delid' parameter, leading to unintended resource access or manipulation. The issue is remotely exploitable without user interaction. Public exploit code is available, reducing the barrier to attack execution.

Business impact

For healthcare organizations using Online Hospital Management System 1.0, this vulnerability could enable authorized users to corrupt or delete doctor scheduling information, potentially disrupting appointment management, staff coordination, and clinical operations. The integrity impact is limited by the requirement for high-privilege credentials, but the availability impact could affect scheduling system reliability. Reputational and operational continuity risks exist if scheduling data is altered maliciously by a compromised admin account.

Affected systems

code-projects Online Hospital Management System version 1.0 is the confirmed affected product. The specific component is viewdoctortimings.php. Organizations running this version in any environment—development, testing, or production—should verify their deployment status. No patch version or fixed release is publicly documented; verify with the vendor for remediation options.

Exploitability

Exploitation requires valid authentication with high-privilege account permissions, which significantly limits attack surface in well-managed environments. However, the CVSS vector (AV:N/AC:L/PR:H) indicates that once authenticated as a privileged user, the attack is straightforward and requires no additional complexity. The public availability of exploit code means that malicious insiders or attackers who compromise a high-privilege account can leverage this flaw without complex tooling. The low barrier to exploitation post-authentication is noteworthy.

Remediation

Contact code-projects for a security patch or update for Online Hospital Management System 1.0. If a patch is not available, implement compensating controls: restrict administrative access to viewdoctortimings.php via web application firewall rules, enforce strong authentication and monitoring for privileged accounts, and maintain audit logs of delid parameter modifications. Consider upgrading to a newer version of the system if one is available and vetted.

Patch guidance

Verify with code-projects for an official security patch addressing CVE-2026-10299. If a patch version is released, test it in a non-production environment before deployment. Prioritize patching instances running in direct patient-facing or production environments. Until a patch is available, layer network and application-level controls to restrict access to the vulnerable file.

Detection guidance

Monitor web server access logs for requests to viewdoctortimings.php containing unusual or high-frequency delid parameter values. Set up alerts on modifications to doctor timing schedules, particularly deletions initiated by high-privilege accounts. Inspect authentication logs for privileged account logins followed by viewdoctortimings.php access. Use web application firewalls (WAF) to detect and block suspicious delid parameter patterns. Database transaction logs should capture any unexpected deletions in scheduling tables.

Why prioritize this

Despite a low CVSS score, the availability of public exploit code and the potential for data integrity compromise in healthcare operations merit timely investigation. However, the high-privilege requirement substantially limits exploitation risk in organizations with mature access controls. Prioritize this for environments with weak privileged account management or where the scheduling system handles critical patient operations. Organizations with strong authentication, monitoring, and least-privilege policies should address this as routine maintenance rather than critical emergency.

Risk score, explained

The CVSS 3.1 score of 3.8 (LOW) reflects the requirement for high-privilege authentication (PR:H), which acts as a strong control. However, the score does not fully capture the presence of public exploit code or the criticality of healthcare scheduling systems. Organizations should supplement this score with risk modeling specific to their access control posture, the sensitivity of doctor scheduling data, and the likelihood of privileged account compromise.

Frequently asked questions