Executive Summary

A SQL injection vulnerability has been discovered in the itsourcecode Hospital Management System 1.0. The vulnerability affects the /patient.php file and allows remote attackers to inject malicious SQL code. The CVSS score for this vulnerability is 6.3, indicating a medium severity level.

Technical Analysis

The vulnerability is classified as a SQL injection (CWE-89) vulnerability. The attack vector is through the network (AV:N), and the attack complexity is low (AC:L). The vulnerability requires low privileges (PR:L) and does not require user interaction (UI:N). The scope of the vulnerability is unchanged (S:U), and the impact on confidentiality, integrity, and availability is low (C:L/I:L/A:L).

How It Gets Exploited

An attacker can exploit this vulnerability by sending a crafted request to the /patient.php file with a malicious SQL query in the editid parameter. For example, an unauthenticated remote attacker could send a request with a manipulated editid parameter that injects malicious SQL code, potentially leading to data breaches or system compromise. If the attack is successful, the attacker could gain access to sensitive data or even take control of the system.

Impact Assessment

The itsourcecode Hospital Management System 1.0 is affected by this vulnerability. The CVSS score of 6.3 indicates a medium severity level. The vulnerability allows remote attackers to inject malicious SQL code, potentially leading to data breaches or system compromise.

Recommended Actions

To mitigate this vulnerability, it is recommended to update the itsourcecode Hospital Management System to a version that is not vulnerable to SQL injection attacks. Additionally, the following measures can be taken:
  • Input validation: Validate user input to prevent malicious SQL code from being injected.
  • Parameterized queries: Use parameterized queries to prevent SQL injection attacks.
  • Limit database privileges: Limit the privileges of the database user to prevent an attacker from accessing sensitive data or taking control of the system.

Sources

  • National Vulnerability Database (NVD)
  • https://nvd.nist.gov/vuln/detail/CVE-2026-14638