Description

A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of the component User Login Handler. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-19T20:17:23.830Z",
  "pubdate": "2026-08-19T20:17:23.830Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified within the User Login Handler component of the code-projects Hospital Information System 1.0. Specifically, the flaw exists in the User::login function located in the includes/users/UsersController.php file. This vulnerability arises from the improper neutralization of user-supplied input passed through the email argument before being incorporated into database queries.\nThe primary impact of this security flaw includes unauthorized database access, potential data exfiltration, bypass of authentication mechanisms, and possible full compromise of the underlying database management system. The attack vector is fully network-accessible, allowing remote threat actors to execute arbitrary SQL commands without requiring prior authentication.\nGiven that an exploit has already been publicly published, the risk implications are severe, and active exploitation in the wild is highly probable. Attackers possess the capability to target remote instances of the affected application directly over the web, leveraging standard HTTP requests containing malicious SQL payloads directed at the vulnerable login endpoint.\nOrganizations utilizing the affected software version must implement immediate defensive controls, as public availability of exploit code significantly lowers the barrier to entry for malicious actors seeking to compromise vulnerable hospital information systems.",
  "technicalDetails": "The vulnerability is classified as a SQL injection (SQLi) flaw residing in the User Login Handler component of code-projects Hospital Information System 1.0. The root cause of the issue stems from the insecure handling of parameters within the User::login function situated inside the includes/users/UsersController.php file. Insecure coding practices fail to properly sanitize, validate, or parameterize user-supplied input received via the email argument prior to executing database queries.\nExploitation of this vulnerability is achieved remotely over the network without requiring any authentication or specific user privileges. An attacker initiates the attack flow by interacting with the application's login interface and submitting a maliciously crafted payload within the email input field. Because the application insecurely concatenates or interpolates this raw input directly into the backend SQL query structure, the database interpreter parses the injected malicious SQL commands as executable code rather than literal data.\nDuring payload behavior, the injected SQL commands alter the intended logic of the authentication query. Depending on the constructed payload, an attacker can manipulate conditional statements to always evaluate to true, thereby bypassing authentication mechanisms to gain unauthorized access to the application. Alternatively, advanced payloads can leverage techniques such as UNION-based SQL injection, error-based extraction, or blind SQL injection to enumerate internal database schemas, extract sensitive patient and user records, or execute administrative operations against the database server.\nThe post-exploitation impact is catastrophic due to the potential exposure of sensitive healthcare data and administrative credentials stored within the database. Because the vulnerability affects a core authentication handler, successful exploitation undermines the confidentiality, integrity, and availability of the entire Hospital Information System 1.0 deployment."
}