Description

A vulnerability was detected in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewadmin.php. The manipulation of the argument delid results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-06T22:16:54.693Z",
  "pubdate": "2026-08-06T22:16:54.693Z",
  "executiveSummary": "A SQL injection vulnerability has been identified in the itsourcecode Hospital Management System 1.0, specifically within the /viewadmin.php endpoint through the manipulation of the delid parameter. This security flaw originates from improper input validation and the direct incorporation of user-supplied data into backend database queries.\nThe vulnerability allows remote unauthenticated attackers to execute arbitrary SQL commands against the underlying database management system. Successful exploitation of this flaw can lead to severe impacts, including unauthorized access to sensitive administrative data, data exfiltration, database manipulation, and potential compromise of the host environment.\nGiven that exploit details are publicly available, the risk to vulnerable deployments is critical. Immediate remediation is required to prevent malicious exploitation by remote threat actors leveraging network connectivity to the application.",
  "technicalDetails": "The vulnerability exists within the /viewadmin.php component of itsourcecode Hospital Management System 1.0. The root cause is the failure of the application to properly sanitize, validate, or parameterize input supplied via the delid HTTP request parameter before passing it into database query execution functions.\nThe attack vector is network-based, allowing remote adversaries to interact directly with the vulnerable file /viewadmin.php. By supplying a specially crafted payload within the delid argument, an attacker can manipulate the syntactic structure of the SQL query executed by the database engine.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies the exposure of /viewadmin.php and recognizes that the delid parameter handles record deletion or retrieval logic. Second, the attacker crafts a malicious input containing SQL syntax (such as UNION-based statements or boolean-based conditions) designed to interfere with the original query logic. Third, the attacker transmits this HTTP request containing the injected payload to the server. Fourth, the application processes the request, appends the unsanitized delid value directly into the database query string, and executes it against the backend database.\nBecause the application fails to utilize prepared statements or parameterized queries, the database interprets the attacker's input as executable code rather than plain data. This results in unintended query logic execution, permitting the retrieval or modification of unauthorized database tables and records.\nThe privileges required to execute this attack depend on the application's access control implementation around /viewadmin.php, but remote exploitation capability is confirmed. Post-exploitation impact includes complete confidentiality and integrity compromise of the underlying database storage."
}