Description

A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /viewdoctorconsultancycharge.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-09T18:16:43.450Z",
  "pubdate": "2026-08-09T18:16:43.450Z",
  "executiveSummary": "An SQL injection vulnerability has been identified within itsourcecode Hospital Management System 1.0. The security flaw resides in the /viewdoctorconsultancycharge.php file, specifically through the manipulation of the delid parameter. This vulnerability allows remote threat actors to execute arbitrary SQL commands against the underlying database without requiring prior authentication.\nThe impact of this flaw is severe, potentially leading to unauthorized data access, data modification, database exfiltration, or complete compromise of the backend database management system. Given that the exploit has been publicly disclosed, the risk of active exploitation by malicious parties is elevated. Attackers can leverage network-based access vectors to interact with the vulnerable application endpoint and supply crafted input designed to break the logic of SQL queries constructed by the web application.",
  "technicalDetails": "The vulnerability is caused by insufficient input sanitization and lack of parameterized queries within the /viewdoctorconsultancycharge.php script of itsourcecode Hospital Management System 1.0. Specifically, user-supplied input passed via the delid parameter is directly concatenated into database SQL query strings without proper escaping or type enforcement.\nThe exploitation method involves an attacker supplying specially crafted malicious SQL payloads through the delid argument via HTTP requests. Because the application fails to adequately validate or parameterize this input, the database interpreter parses the injected string as executable SQL commands rather than inert data literals.\nThe attack flow proceeds as follows: First, the remote attacker identifies the vulnerable endpoint at /viewdoctorconsultancycharge.php and targets the delid parameter. Second, the attacker crafts an HTTP request containing SQL injection syntax within the delid value. Third, the application processes the request and dynamically constructs an SQL query incorporating the malicious input. Fourth, the database executes the resulting compromised query, returning sensitive database contents or executing unauthorized database operations back to the attacker.\nThe affected component is the unknown function handling database deletion or data retrieval logic associated with the delid argument inside /viewdoctorconsultancycharge.php. This vulnerability is exposed over the network, allowing remote attackers to execute attacks without authentication or elevated privileges."
}