Description

A vulnerability has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewpatient.php. Such manipulation of the argument delid leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-17T02:16:41.383Z",
  "pubdate": "2026-08-17T02:16:41.383Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified within the itsourcecode Hospital Management System 1.0. The vulnerability exists in an unknown function processing the delid parameter located in the /viewpatient.php file. This security flaw allows remote unauthenticated or authenticated attackers to manipulate database queries by injecting malicious SQL payloads through the vulnerable HTTP request parameter. Successful exploitation of this vulnerability can lead to unauthorized access, data exfiltration, database manipulation, and potential full compromise of the underlying database management system. The attack vector is fully remote, and public exploit disclosures increase the risk of active exploitation in production environments. Immediate remediation is required to secure the affected file and parameter against improper input neutralization.",
  "technicalDetails": "The vulnerability is rooted in insufficient input validation and improper sanitization of user-supplied data passed to the delid parameter within the /viewpatient.php endpoint of itsourcecode Hospital Management System 1.0. When a user or automated script submits a crafted HTTP request containing malicious SQL syntax via the delid argument, the underlying application logic dynamically constructs a database query without properly parameterizing the input or utilizing prepared statements.\nThe attack flow proceeds as follows: First, the attacker identifies the exposure of the /viewpatient.php endpoint and targets the vulnerable delid parameter, typically used for deleting patient records. Second, the attacker crafts a malicious SQL injection payload designed to alter the logic of the database query, such as appending UNION-based statements, boolean-based conditions, or error-based extraction techniques. Third, the HTTP request containing the payload is transmitted over the network to the target web server. Fourth, the application passes the unsanitized input directly into the database query execution context. Finally, the database interprets the injected SQL commands, returning sensitive information, executing administrative commands, or modifying database contents depending on the privileges of the database connection.\nThe affected component is the server-side script handling record deletion logic in /viewpatient.php. The vulnerability is accessible over the network, allowing remote attackers to initiate exploitation without prior access to the internal network. The impact of successful exploitation includes unauthorized read and write access to the database, potential compromise of patient health records, and total loss of confidentiality, integrity, and availability of the database system supporting the Hospital Management System 1.0."
}