Description

A flaw has been found in itsourcecode Hospital Management System Project in PHP 1.0. This impacts an unknown function of the file /viewservicetype.php. This manipulation of the argument delid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-23T10:16:28.333Z",
  "pubdate": "2026-08-23T10:16:28.333Z",
  "executiveSummary": "An SQL injection vulnerability has been identified within the itsourcecode Hospital Management System Project in PHP 1.0. This security flaw specifically impacts an unknown function within the /viewservicetype.php file via the manipulation of the delid parameter. The vulnerability allows remote attackers to inject malicious SQL commands directly into database query structures, potentially compromising the integrity, confidentiality, and availability of the underlying database. The risk implications are severe, as exploitation can lead to unauthorized data access, database modification, or complete system compromise. The attack can be initiated remotely without requiring prior authentication, depending on the application configuration, and public exploits are currently available, increasing the likelihood of opportunistic exploitation in vulnerable deployments.",
  "technicalDetails": "The root cause of this vulnerability stems from insufficient input validation and a lack of parameterization within the database interaction logic of the itsourcecode Hospital Management System Project in PHP 1.0. Specifically, the application processes user-supplied input submitted through the delid argument in the vulnerable /viewservicetype.php endpoint without proper sanitization, escaping, or the use of prepared statements.\nDuring the attack flow, a remote unauthenticated adversary crafts a malicious HTTP request containing SQL payloads injected directly into the delid parameter. Because the application insecurely concatenates this raw, untrusted input into a dynamic SQL query, the database management system interprets the injected string as executable SQL commands rather than literal parameter data.\nThe vulnerable component resides in the backend request handling logic associated with /viewservicetype.php, where database deletion or retrieval operations are performed based on the value of delid. Depending on the exact structure of the vulnerable SQL query, an attacker can manipulate database logic to bypass security controls, extract sensitive information from other database tables via UNION-based attacks, perform error-based data extraction, or execute destructive commands affecting stored records.\nNetwork exposure is fully remote, as the vulnerable file is typically accessible via standard web protocols over HTTP or HTTPS. Authentication and privilege requirements are absent or minimal, allowing external threat actors to interact directly with the script. Given that the exploit has been publicly published, automated scanning and manual exploitation vectors present an immediate risk to any deployment running version 1.0 of the affected software."
}