Description

A vulnerability was identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file /viewdoctor.php. Such manipulation of the argument delid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-09T11:16:51.660Z",
  "pubdate": "2026-08-09T11:16:51.660Z",
  "executiveSummary": "An SQL injection vulnerability has been identified within itsourcecode Hospital Management System 1.0. Specifically, the flaw exists in the processing mechanism of the file /viewdoctor.php, where user-supplied input via the delid parameter is improperly sanitized and handled. This vulnerability allows remote unauthenticated or remote authenticated attackers to manipulate database queries, leading to unauthorized access, data exfiltration, or database compromise. The risk implications are severe, as exploitation can compromise the confidentiality, integrity, and availability of the underlying database storing sensitive healthcare and administrative information. The attack can be executed remotely over the network without requiring complex prerequisites, and public availability of exploit material significantly elevates the real-world risk of exploitation. Remediation requires proper input validation, parameterization of database queries, and implementation of secure coding practices to eliminate dynamic query construction using untrusted input.",
  "technicalDetails": "The vulnerability is rooted in insufficient input validation and improper sanitization of parameters supplied to backend database queries within the application's source code. Specifically, the attack vector targets the /viewdoctor.php endpoint, where the delid argument is dynamically concatenated or directly interpolated into an SQL query string without adequate contextual output encoding, parameter binding, or escaping.\nThe attack flow begins when a remote attacker crafts a malicious HTTP request targeting /viewdoctor.php, injecting specialized SQL syntax payload vectors into the delid parameter. Because the application fails to enforce strict type checking or utilize prepared statements, the database query interpreter processes the attacker-supplied input as executable database commands rather than literal string data.\nThe vulnerable component resides in the backend database interaction logic associated with the deletion or retrieval routines executed by /viewdoctor.php. The affected product version is itsourcecode Hospital Management System 1.0. Depending on the database configuration and application permissions, successful execution of the injected payload allows the attacker to manipulate the structure of the original SQL query, bypass authentication mechanisms, extract sensitive database contents, modify records, or potentially execute arbitrary system commands via database features if misconfigured.\nNetwork exposure is remote, allowing malicious actors across the network to initiate exploitation vectors against deployed instances of the application. The specific authentication and privilege requirements depend on the access control enforcement surrounding the /viewdoctor.php file, though vulnerabilities of this nature frequently bypass inadequate session checks if the endpoint is reachable directly. Post-exploitation impact includes full database compromise, unauthorized data enumeration of patient and doctor records, potential data destruction, and further pivoting opportunities within the compromised hosting environment."
}