Description

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewmedicine.php. Performing a manipulation of the argument delid results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-15T13:17:48.153Z",
  "pubdate": "2026-08-15T13:17:48.153Z",
  "executiveSummary": "A security flaw has been identified in itsourcecode Hospital Management System 1.0, specifically within an unknown function handling the delid parameter in the /viewmedicine.php file. This vulnerability is classified as a SQL Injection (SQLi) flaw, which allows remote attackers to manipulate database queries by injecting malicious SQL payloads through the vulnerable HTTP request parameter. The impact of successful exploitation includes unauthorized access to sensitive backend database contents, potential data tampering, and compromise of the underlying database server integrity. The vulnerability is accessible over the network without requiring authentication, depending on the application configuration, and public exploits have been released, significantly elevating the associated risk and urgency for remediation. Attackers can execute this attack remotely without prior privileges, posing an immediate threat to deployments of the affected product version.",
  "technicalDetails": "The vulnerability resides in the backend processing logic associated with the /viewmedicine.php script of itsourcecode Hospital Management System 1.0. Specifically, the input passed via the delid argument fails to undergo proper sanitization, validation, or parameterized query implementation before being concatenated directly into database queries executed against the backend database management system. This root cause enables an attacker to inject arbitrary SQL commands into the application context.\nThe attack flow begins with a remote malicious actor crafting an HTTP request targeting the /viewmedicine.php endpoint. The attacker appends a maliciously crafted payload designed to alter the intended logic of the SQL query within the delid parameter. Because the application trusts and improperly handles this input, the database engine interprets the injected strings as executable SQL commands rather than inert user-supplied data.\nNetwork exposure for this vulnerability is remote, meaning attackers can interact with the vulnerable component over the internet or local network depending on deployment architecture. Authentication and privilege requirements are not explicitly restricted by the vulnerable function, allowing unauthenticated remote attackers to trigger the flaw. Payload behavior during exploitation can range from extracting sensitive data via boolean-based, error-based, or time-based SQL injection techniques to potentially modifying or deleting records depending on database user privileges configured for the application.\nPost-exploitation impact includes full compromise of the database storing hospital management records, potentially exposing confidential patient data, administrative credentials, and system information. Remediation requires refactoring the vulnerable PHP code to use prepared statements and parameterized queries."
}