Description

A vulnerability has been found in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /vieworder.php. The manipulation of the argument delid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-16T06:16:52.773Z",
  "pubdate": "2026-08-16T06:16:52.773Z",
  "executiveSummary": "A vulnerability has been identified in itsourcecode Hospital Management System 1.0, specifically within the /vieworder.php file. The flaw is classified as a SQL Injection (SQLi) vulnerability, arising from the improper handling of user-supplied input passed via the delid argument. This security defect allows remote attackers to manipulate database queries directly, potentially leading to unauthorized data access, modification, or deletion, as well as full compromise of the underlying database architecture. The vulnerability is accessible over the network without requiring authentication, presenting a severe risk to the confidentiality, integrity, and availability of the affected system. Public disclosure of the exploit increases the likelihood of malicious exploitation in the wild, necessitating immediate remediation or defensive hardening by system administrators.",
  "technicalDetails": "The vulnerability resides in the order management component of itsourcecode Hospital Management System 1.0, specifically processing requests handled by the /vieworder.php script. The root cause of the vulnerability is insufficient input validation and a lack of parameterization for database queries interacting with the delid argument. When a remote user supplies crafted input to the delid parameter, the application directly incorporates the untrusted data into dynamically constructed SQL statements executed against the backend database management system.\nThe attack vector is fully network-accessible, allowing unauthenticated remote threat actors to execute arbitrary SQL commands. The attack flow commences when an attacker crafts a malicious HTTP GET or POST request containing SQL payload syntax injected into the delid parameter of /vieworder.php. Because the application fails to sanitize the input or utilize prepared statements, the database engine interprets the injected strings as executable SQL commands rather than literal parameter values.\nPost-exploitation impact depends on the privileges associated with the database user account executing the query. Potential consequences include extraction of sensitive hospital records, patient data, administrator credentials, and internal system configurations. In highly permissive environments, an attacker could leverage the SQL injection vector to execute operating system commands or perform administrative database operations, resulting in complete system takeover."
}