CVE-2026-9603: SourceCodester eDoc Doctor Appointment System delete-session.php authorization
A security vulnerability has been detected in SourceCodester eDoc Doctor Appointment System 1.0. This affects an unknown part of the file /admin/delete-session.php. The manipulation of the argument ID leads to missing authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure /admin/delete-session.php performs server-side authorization checks on the ID argument: validate input, confirm the authenticated user has permission to delete the referenced session, and deny the request if authorization fails.
SourceCodester eDoc Doctor Appointment System (admin/delete-session.php) authorization_check_on_ID_parameter = enabled / validate ownership and permissions - Compensating control
Restrict remote access to the /admin/ area (including delete-session.php) using network controls: limit to trusted IPs or VPN, enforce strong authentication, and/or place the admin interface behind a firewall or WAF to block unauthorized requests.
- Operational
Review web and application logs for requests to /admin/delete-session.php (and manipulations of the ID parameter) to detect possible exploitation. If unauthorized deletions are found, investigate impact, restore affected data from backups as needed, and rotate any credentials or sessions that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9603?
CVE-2026-9603 has a medium severity rating of 6.5.
How does CVE-2026-9603 affect the SourceCodester eDoc Doctor Appointment System?
CVE-2026-9603 affects the file /admin/delete-session.php, allowing for missing authorization due to manipulation of the argument ID.
Can CVE-2026-9603 be exploited remotely?
Yes, CVE-2026-9603 allows for remote exploitation.
What impact does CVE-2026-9603 have on system integrity?
CVE-2026-9603 leads to a potential loss of integrity as it allows unauthorized operations to be performed.
How can the vulnerability CVE-2026-9603 be mitigated?
To mitigate CVE-2026-9603, ensure proper authorization checks are implemented in the /admin/delete-session.php file.