Description

A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the function viewReq of the file viewReq.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-04T03:17:46.327Z",
  "pubdate": "2026-09-04T03:17:46.327Z",
  "executiveSummary": "The Hospital Information System version 1.0 is affected by a critical SQL injection vulnerability within the viewReq.php script. This flaw arises from improper neutralization of user-supplied input provided via the ID parameter before using it in a database query.\nThe vulnerability allows remote, unauthenticated attackers to manipulate SQL commands, potentially leading to unauthorized data exfiltration, modification of database contents, or full compromise of the underlying data store.\nGiven that exploit code is publicly available, the risk to the confidentiality, integrity, and availability of sensitive hospital records is high. Immediate remediation is required to sanitize all input vectors interfacing with the database.",
  "technicalDetails": "The vulnerability is located in the viewReq function within the viewReq.php file of the Hospital Information System 1.0 application. The root cause is the insecure handling of the 'ID' GET/POST parameter, which is concatenated directly into a SQL query string without appropriate input sanitization, parameterization, or the use of prepared statements.\nExploitation occurs when an attacker supplies a crafted payload in the ID parameter. Because the application fails to distinguish between data and SQL commands, the database management system executes the injected code as part of the intended query. An attacker can leverage this to terminate the original query prematurely using special characters such as the single quote (') or comment syntax (--, #, /*).\nThe attack flow proceeds as follows: 1) The attacker identifies the vulnerable entry point via the ID parameter in viewReq.php. 2) The attacker submits a malicious string designed to alter the query logic, such as appending a UNION SELECT statement. 3) The backend server processes the query and executes the attacker's SQL commands against the database. 4) The application returns the results of the malicious query to the attacker, or performs unauthorized operations such as dropping tables or administrative credential extraction.\nSince the attack is network-exploitable, it does not require prior authentication. The impact is significant; an attacker can perform blind or error-based SQL injection to systematically extract the entire contents of the database, bypass authentication mechanisms, or execute administrative commands if the database user permissions are overly permissive. The availability of public exploits significantly lowers the barrier to entry for malicious actors, increasing the likelihood of successful exploitation against exposed instances."
}