Description

A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-31T21:17:54.860Z",
  "pubdate": "2026-08-31T21:17:54.860Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in kishan0725 Hospital-Management-System version 1.0, specifically within the /search.php file. The vulnerability stems from improper neutralization of user-supplied data within the Contact argument before it is utilized in backend database queries.\nThe flaw permits unauthenticated remote attackers to inject arbitrary SQL commands, potentially leading to unauthorized data exfiltration, modification, or deletion within the underlying database. The vulnerability poses a severe risk as exploit code is publicly available and the vendor remains unresponsive to disclosure attempts.\nSuccessful exploitation allows attackers to bypass application security controls, compromise sensitive patient data, and potentially gain further insight into the system's database architecture. Given the public availability of the exploit, systems running this version are at immediate risk of exploitation by remote actors.",
  "technicalDetails": "The vulnerability is classified as an SQL injection (SQLi) flaw located within the /search.php script of the Hospital-Management-System 1.0 application. The root cause of the vulnerability is the lack of parameterized queries or adequate input sanitization when processing the 'Contact' HTTP GET or POST parameter.\nWhen a user submits input via the 'Contact' field, the application concatenates this input directly into a dynamic SQL query string executed against the database. Because the application fails to distinguish between legitimate data and malicious SQL syntax, an attacker can supply crafted input containing SQL control characters, such as single quotes, comments, or logical operators (e.g., OR 1=1).\nThe attack flow proceeds as follows: First, the attacker identifies the /search.php endpoint as the target for interaction. Second, the attacker crafts a malicious payload targeting the 'Contact' argument. For example, by inputting '1' OR '1'='1' into the field, the attacker can force the database to return all records rather than a single specific patient record. More advanced payloads allow for union-based SQL injection, enabling the attacker to map out the database schema, identify table names, and eventually extract sensitive credentials or patient medical records.\nSince the application does not require authentication to access the search functionality, the attack is fully remote and does not necessitate prior system knowledge or high-level privileges. The exposure is limited only by the attacker's ability to reach the /search.php file over the network. Once the SQL injection is successfully executed, the post-exploitation impact is extensive: an attacker could perform 'blind' SQL injection to extract data bit-by-bit if error messages are suppressed, or perform blind time-based attacks to infer data contents.\nBecause the vendor has not provided a patch for this disclosure, the code remains inherently vulnerable. The lack of input validation or the use of prepared statements (e.g., using PDO or MySQLi with prepared statements) in the /search.php file serves as the primary technical failure point allowing this vulnerability to exist."
}