Executive Summary

A SQL injection vulnerability was identified in itsourcecode Hospital Management System 1.0, specifically in the /viewdoctor.php file. This issue allows remote attackers to inject malicious SQL code, potentially leading to data breaches or system compromise. The vulnerability has a CVSS score of 6.3 and is classified as medium severity.

Technical Analysis

The vulnerability is caused by improper input validation in the delid argument of the /viewdoctor.php file. This allows an attacker to inject malicious SQL code, potentially leading to data breaches or system compromise. The attack vector is remote, and the exploit is publicly available.

Vulnerability Class

The vulnerability class is SQL Injection (CWE-89).

Attack Vector

The attack vector is remote, and the attacker can inject malicious SQL code through the delid argument of the /viewdoctor.php file.

How It Gets Exploited

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted request to the /viewdoctor.php file with a malicious delid parameter. For example, an attacker can send a request with a delid parameter that contains malicious SQL code, such as a UNION operator or a system function call. If the input is not properly validated, the malicious SQL code can be executed, potentially leading to data breaches or system compromise.

Impact Assessment

The vulnerability affects itsourcecode Hospital Management System 1.0. An attacker can achieve confidentiality, integrity, and availability impacts, with a CVSS score of 6.3.

Recommended Actions

To mitigate this vulnerability, it is recommended to:
  • Update the itsourcecode Hospital Management System to a version that fixes this vulnerability (not specified in the source data).
  • Implement input validation and sanitization for the delid parameter in the /viewdoctor.php file.
  • Use prepared statements with parameterized queries to prevent SQL injection.
  • Monitor the system for suspicious activity and implement logging and auditing mechanisms.

Sources

  • National Vulnerability Database (NVD)
  • https://nvd.nist.gov/vuln/detail/CVE-2026-19347
  • https://github.com/ltranquility/submit_vuln/issues/17
  • https://itsourcecode.com/
  • https://vuldb.com/cve/CVE-2026-19347