SQL Injection Vulnerability in HashenUdara Appointment System
CVE-2026-116112

6.9MEDIUM

Key Information:

Vendor

Hashenudara

Status
Edoc-doctor-appointment-system
Vendor
CVE Published:
26 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-116112?

A vulnerability has been detected in HashenUdara's edoc-doctor-appointment-system due to an exploitable SQL injection in the admin/add-new.php file. By manipulating the 'spec' argument, an attacker can remotely execute this exploit. The attack method is publicly accessible and poses a risk to users, particularly as the product operates on a rolling release model, complicating version tracking and updates. Despite early notification to the vendor about this vulnerability, there has been no response.

Affected Version(s)

edoc-doctor-appointment-system cc258425b915d1af9e298777ccd26d160493e68d

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-116112 - Proof of Concept

References

https://vuldb.com/vuln/426180
vdb-entrytechnical-description
https://vuldb.com/vuln/426180/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-116112
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

hbynb (VulDB User)
VulDB CNA Team
.