Description

A vulnerability was detected in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewprescriptionrecord.php. The manipulation of the argument delid results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-17T08:16:59.890Z",
  "pubdate": "2026-08-17T08:16:59.890Z",
  "executiveSummary": "An SQL injection vulnerability has been identified within itsourcecode Hospital Management System 1.0, specifically residing in the file /viewprescriptionrecord.php through the manipulation of the delid parameter. This flaw allows remote, unauthenticated attackers to interact directly with the underlying database management system, potentially bypassing security controls to extract, modify, or delete sensitive application data.\nThe presence of this vulnerability poses severe risk implications for deployments of the affected software, as public availability of the exploit lowers the barrier to entry for malicious actors. Successful exploitation compromises the confidentiality, integrity, and availability of the database, exposing patient records and system administrative data. Attackers can execute arbitrary SQL commands remotely over the network without requiring prior authentication or privileged access, provided they can reach the target endpoint.",
  "technicalDetails": "The vulnerability stems from improper neutralization of special elements used in an SQL command, a classic classification of SQL Injection (SQLi). The vulnerable component is located within the script /viewprescriptionrecord.php, where user-supplied input passed via the delid parameter is processed by an unknown function without adequate sanitization, parameterization, or input validation before being concatenated directly into database queries.\nThe attack flow begins when an attacker crafts a malicious HTTP request containing SQL syntax payload vectors injected into the delid parameter. Because the application fails to utilize parameterized queries or prepared statements, the database interpreter parses the attacker-controlled input as executable database commands rather than literal string data. This permits the manipulation of the original query logic.\nNetwork exposure for this vulnerability is remote, meaning an attacker can transmit payloads over HTTP/HTTPS directly to the target web server hosting itsourcecode Hospital Management System 1.0. No authentication or specific user privileges are enforced prior to the execution of the vulnerable code path in /viewprescriptionrecord.php, enabling anonymous or low-privileged network access to trigger the flaw.\nThe payload behavior during exploitation involves breaking out of the intended query structure, allowing the execution of stacked queries, boolean-based inferences, error-based extractions, or union-based retrievals. Post-exploitation impact includes unauthorized data exfiltration of sensitive hospital records, potential manipulation of prescription data, and in severely misconfigured database environments, execution of operating system commands or complete database server compromise."
}