Description

A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.php. This manipulation of the argument Search causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-04T02:17:20.363Z",
  "pubdate": "2026-09-04T02:17:20.363Z",
  "executiveSummary": "The Hospital Information System version 1.0 is affected by a critical SQL injection vulnerability residing within the addReq.php file.\nThe vulnerability originates from the improper sanitization of the Search argument processed by the findBySearch function.\nThis flaw permits an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database, potentially resulting in unauthorized data exposure, modification, or complete system compromise.\nGiven that the exploit is publicly disclosed, the risk to organizations deploying this software is severe, as it does not require prior authentication or elevated privileges to initiate the attack.\nThe exploitation allows an adversary to manipulate database queries, bypassing application-level security controls to exfiltrate sensitive patient records or administrative credentials.\nImmediate remediation is necessary to prevent unauthorized access to the underlying database infrastructure.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located in the addReq.php component of the Hospital Information System 1.0. The root cause is the insecure handling of user-supplied input via the Search parameter, which is passed directly to the findBySearch function without sufficient input validation or the use of prepared statements.\nWhen an attacker provides a maliciously crafted string via the Search argument, the application fails to distinguish between legitimate user data and executable SQL commands. Because the input is dynamically concatenated into the database query, the attacker can break out of the intended query structure to append or modify SQL logic using union-based, error-based, or blind injection techniques.\nThe attack flow begins when an external entity sends an HTTP request containing a crafted payload within the Search parameter to the vulnerable addReq.php endpoint. The backend script receives this input and executes the findBySearch function, which processes the input string as part of a database query. By injecting specific syntax—such as ' OR 1=1 -- or stacked queries—the attacker forces the database to return unintended results or execute administrative actions.\nThis vulnerability is accessible via the network, allowing remote exploitation without the need for authentication. The database, acting as the backend for the application, interprets the injected commands with the privileges assigned to the database user account defined in the application's configuration file. If the application connects with high-level privileges, the attacker may be able to dump entire database tables, perform unauthorized administrative updates, or even extract system-level information.\nThe impact of successful exploitation is significant. Beyond mere data exfiltration of patient information, an attacker could potentially gain unauthorized access to administrative sessions if the credentials are stored within the database. Furthermore, in environments where the database user has sufficient filesystem permissions, an attacker might leverage database-specific functions to perform arbitrary file reads or writes on the host server, leading to full application compromise and potential remote code execution."
}