Description

A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewroom.php. Such manipulation of the argument delid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-18T01:16:42.673Z",
  "pubdate": "2026-08-18T01:16:42.673Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability has been identified within the itsourcecode Hospital Management System 1.0 application. Specifically, the flaw exists in an unknown function processing the delid parameter located in the /viewroom.php endpoint. This security defect enables remote attackers to manipulate database queries by injecting arbitrary SQL commands through the vulnerable HTTP request parameter. Successful exploitation of this vulnerability can lead to unauthorized access, data exfiltration, database modification, or potential full compromise of the underlying database management system. The attack vector is fully remote and does not require prior authentication, significantly increasing the risk profile for deployments running the affected software version. Public disclosure of the exploit details further elevates the likelihood of malicious exploitation in the wild, necessitating immediate remediation or defensive hardening actions.",
  "technicalDetails": "The vulnerability is fundamentally rooted in the lack of proper input sanitization and parameterized querying within the codebase of itsourcecode Hospital Management System 1.0. The flaw specifically resides in the /viewroom.php file, where user-supplied input provided via the delid parameter is directly concatenated or unsafely incorporated into backend SQL query statements without adequate escaping or type enforcement.\nThe attack flow proceeds as follows: An unauthenticated remote attacker crafts an HTTP request targeting the /viewroom.php endpoint, supplying malicious SQL payloads within the delid argument. Because the application fails to validate or sanitize this input, the database query interpreter parses the attacker-controlled input as executable SQL code rather than literal data parameters. Depending on the constructed query, this allows the execution of arbitrary database commands.\nThe vulnerable component is the database interaction logic handling the deletion or processing of room records associated with the delid parameter. The affected software version is strictly version 1.0. The vulnerability is accessible over the network via standard HTTP/HTTPS protocols, requires no authentication or special privileges, and can be exploited remotely by any external threat actor capable of reaching the web application.\nPost-exploitation impact includes the potential extraction of sensitive database contents such as patient records, administrative credentials, and system configurations. Furthermore, depending on the database user privileges configured for the application, an attacker may be able to execute operating system commands, write malicious web shells to the underlying web server, or cause a complete denial of service against the database infrastructure."
}