Description

A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentapproved.php. Performing a manipulation of the argument delid results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-20T15:18:39.760Z",
  "pubdate": "2026-08-20T15:18:39.760Z",
  "executiveSummary": "A SQL injection vulnerability has been identified in the itsourcecode Hospital Management System 1.0 application. Specifically, the flaw resides within the /viewappointmentapproved.php endpoint due to improper handling of user-supplied input.\nThe vulnerability allows remote attackers to manipulate the delid parameter to execute arbitrary SQL commands against the underlying database. Successful exploitation of this flaw can lead to unauthorized access, data extraction, modification, or deletion of sensitive database contents, posing significant risks to confidentiality, integrity, and availability.\nThe attack can be executed remotely over the network without requiring prior authentication or elevated privileges, provided the target system is accessible to the attacker. Publicly available exploit material increases the likelihood of opportunistic exploitation against vulnerable deployments.\nOrganizations utilizing the affected software must implement strict input validation and parameterized queries to neutralize the risk of unauthorized database interaction.",
  "technicalDetails": "The vulnerability is classified as a SQL injection (SQLi) flaw affecting the itsourcecode Hospital Management System 1.0 software. The root cause of the vulnerability stems from insufficient sanitization, validation, and contextual escaping of input passed via the delid parameter.\nThe vulnerable component is located in the backend logic processed by the /viewappointmentapproved.php file. When a user or automated script submits a crafted HTTP request containing malicious SQL syntax within the delid parameter, the application incorporates this input directly into dynamic database queries without employing parameterized statements or prepared statements.\nThe attack flow proceeds as follows: An unauthenticated or remote attacker crafts an HTTP request targeting /viewappointmentapproved.php, injecting malicious SQL payloads into the delid parameter. The application interprets the user-supplied data as executable database commands rather than literal string data. Consequently, the database management system evaluates the injected query structure, allowing the attacker to manipulate the intended logic of the SQL statement.\nDepending on the nature of the payload, post-exploitation impact can include extracting sensitive patient and administrative records, bypassing authentication mechanisms, or executing administrative operations directly on the backend database management system. Network exposure is direct, as the endpoint is accessible remotely via standard web protocols. No special privileges or prior authentication are strictly required to initiate the attack vector, lowering the barrier to entry for potential threat actors."
}