Description

A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Executing a manipulation of the argument delid can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-14T02:16:23.757Z",
  "pubdate": "2026-08-14T02:16:23.757Z",
  "executiveSummary": "An SQL injection vulnerability has been identified within the itsourcecode Hospital Management System 1.0 application. Specifically, the flaw exists in an unknown processing mechanism within the file viewdoctortimings.php, where the parameter delid is improperly sanitized before being utilized in database queries. This vulnerability allows remote unauthenticated attackers to manipulate SQL statements, leading to unauthorized database access and potential data exfiltration or manipulation.\nThe impact of this security flaw is critical, as successful exploitation can compromise the integrity, confidentiality, and availability of the underlying database. Attackers can leverage this vulnerability to bypass access controls, extract sensitive information such as patient and doctor records, or execute arbitrary database commands. Given that exploit details have been made publicly available, the risk of active exploitation is elevated, necessitating immediate remediation or containment measures.",
  "technicalDetails": "The root cause of this vulnerability is the lack of proper input validation and parameterized queries for the delid parameter handled by the vulnerable file viewdoctortimings.php. When user-supplied input is directly concatenated into dynamic SQL queries without adequate sanitization or escaping, the application becomes susceptible to SQL injection attacks.\nThe attack vector is remote, allowing an external adversary to transmit malicious input over the network without requiring prior authentication or specific privileges within the system. The attacker initiates the attack by sending a crafted HTTP request containing malicious SQL payloads targeted at the delid parameter within the context of viewdoctortimings.php.\nUpon receiving the request, the vulnerable script incorporates the unsanitized input directly into database execution routines. The database management system interprets the injected characters as executable SQL syntax rather than literal data. This alters the intended logic of the database query, allowing the attacker to execute arbitrary SQL commands.\nPost-exploitation impact includes the potential retrieval of sensitive database contents, modification of system records, or potentially underlying operating system interaction depending on the database server configuration and privileges. The lack of robust input filtering mechanisms across the affected component enables these unauthorized operations to execute successfully."
}