Critical Vulnerability Information Affected Product Open Source Clinic Management System Affected Version V1.0 Vulnerable File /email_config.php Vulnerability Type SQL Injection Root Cause In the 'email_config.php' file, attackers can inject malicious code via the 'mail_port' parameter, which is directly used in SQL queries without proper sanitization or validation. Impact Attackers can exploit this SQL injection vulnerability to achieve unauthorized database access, sensitive data leakage, data tampering, disruption of system control, and even service denial, posing a severe threat to system security and business continuity. Description A critical SQL injection vulnerability has been discovered in the 'email_config.php' file. This vulnerability stems from inadequate validation of user input, allowing attackers to inject malicious SQL statements. As a result, attackers can gain unauthorized access to the database, modify or delete data, and access sensitive information. Vulnerability Details and POC Vulnerable Parameter: 'mail_port' Payload: Recommended Remediation 1. Use prepared statements and parameter binding. 2. Implement input validation and filtering. 3. Minimize database user privileges. 4. Conduct regular security audits.