Description

A vulnerability was found in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /viewpaymentreport.php. Performing a manipulation of the argument delid results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-17T03:16:49.750Z",
  "pubdate": "2026-08-17T03:16:49.750Z",
  "executiveSummary": "A SQL injection vulnerability has been identified within itsourcecode Hospital Management System 1.0, specifically affecting the /viewpaymentreport.php endpoint. This security flaw stems from the improper handling of user-supplied input submitted via the delid parameter. An unauthenticated remote attacker can exploit this vulnerability by manipulating the delid argument to inject malicious SQL queries directly into the backend database execution context. Successful exploitation of this flaw can lead to unauthorized access, data exfiltration, database manipulation, and potential compromise of the underlying database management system. The attack vector is fully remote, and because the exploit has been made public, the risk of exploitation is significantly elevated. Remediation requires implementing strict input sanitization, parameterized queries, and prepared statements across all database interactions to ensure untrusted data is not interpreted as executable code.",
  "technicalDetails": "The vulnerability is classified as a SQL Injection (SQLi) flaw located in the /viewpaymentreport.php script of itsourcecode Hospital Management System 1.0. The root cause of the vulnerability is the lack of proper input validation and sanitization of the delid parameter before it is concatenated directly into a database query statement. The vulnerable component processes HTTP requests containing the delid parameter and improperly trusts the input supplied by the client. An attacker initiates the attack remotely by crafting a malicious HTTP request where the delid argument is substituted with SQL syntax or operator payloads. When the application executes the resulting query, the database management system interprets the attacker-controlled input as part of the SQL command, altering the intended query logic. The attack flow begins with the adversary identifying the exposure of /viewpaymentreport.php and the vulnerable delid parameter. The attacker then transmits the crafted exploit payload over the network. Upon receipt, the backend application evaluates the concatenated SQL query, executing malicious commands within the database context. Depending on the structure of the query and database permissions, post-exploitation impact includes the extraction of sensitive hospital records, authentication credentials, payment details, or administrative data. Authentication and privilege requirements are minimal or non-existent, allowing remote unauthenticated adversaries to execute the attack vector over standard network protocols. Network exposure is direct, as the vulnerable script is accessible via standard web interfaces."
}