SourceCodester Patients Waiting Area Queue Management System Improper Authorization Vulnerability in patient-search.php

An information disclosure vulnerability exists in SourceCodester Patients Waiting Area Queue Management System version 1.0. The issue is located in the file patient-search.php, where the application performs an unrestricted database query. This query embeds the entire patient dataset, including names, dates of birth, phone numbers, and internal identifiers, into a client-side JavaScript variable without any authentication. As a result, unauthenticated remote users can access sensitive patient information.

Impact

Exploitation of this vulnerability leads to unauthorized access to personal identifiable information of patients, including names, dates of birth, phone numbers, and internal identifiers.

Reproduction

The vulnerability can be reproduced by sending a request to the patient-search.php file. The response will include a JavaScript variable named 'Patients' that contains the entire patient database. This can be done using a curl command that requests the patient-search.php file and filters the response to show the 'Patients' variable.