Description

A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /viewdepartment.php. Performing a manipulation of the argument delid results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-18T01:16:42.907Z",
  "pubdate": "2026-08-18T01:16:42.907Z",
  "executiveSummary": "A security vulnerability has been identified in the itsourcecode Hospital Management System 1.0, specifically within the /viewdepartment.php endpoint. The flaw is classified as a SQL Injection (SQLi) vulnerability, which arises from the improper neutralization of user-supplied input prior to its inclusion in database queries.\nThe vulnerability allows remote attackers to manipulate the delid parameter, leading to unauthorized execution of arbitrary SQL commands against the underlying database. The impact of this security deficiency is severe, potentially granting malicious actors unauthorized access to sensitive database contents, including patient records, administrative credentials, and system configurations. Furthermore, successful exploitation could enable data tampering, deletion, or complete compromise of the database server depending on the privileges associated with the database connection.\nThe attack vector is network-based, meaning an attacker can initiate the exploitation remotely without prior authentication, assuming public or network access to the target web application. Given that exploit code has been publicly disclosed, the risk of automated or opportunistic exploitation is heightened. Remediation requires rigorous input validation and the adoption of parameterized queries or prepared statements to ensure that user input is treated strictly as data rather than executable code.",
  "technicalDetails": "The vulnerability resides in the /viewdepartment.php script of itsourcecode Hospital Management System 1.0. The root cause of the flaw is the direct integration of untrusted HTTP input into dynamic SQL query strings without adequate sanitization, escaping, or parameterization.\nSpecifically, the vulnerability is triggered via the delid parameter, which is processed by the application to handle deletion or retrieval operations related to department records. When an unauthenticated remote attacker supplies specially crafted malicious SQL payloads via the delid parameter, the web application fails to validate the input type or structure.\nThe attack flow proceeds as follows: First, the attacker identifies the vulnerable endpoint at /viewdepartment.php and targets the delid parameter. Second, the attacker crafts a malicious HTTP GET or POST request containing SQL metacharacters designed to break out of the intended query context and append arbitrary SQL commands. Third, the application interpolates the malicious string directly into the backend database query statement. Fourth, the database management system (DBMS) parses and executes the modified query, allowing the attacker to interact with the database logic.\nBecause the vulnerability is exposed via the network layer, no prior authentication or administrative privileges are inherently required to submit the crafted request, assuming the /viewdepartment.php file is accessible to external users. The post-exploitation impact includes the potential extraction of confidential database tables via union-based SQL injection, error-based information disclosure, or blind SQL injection techniques. In scenarios where database user permissions are overly permissive, an attacker might also execute stacked queries to modify data or interact with the underlying operating system."
}