Description

A security flaw has been discovered in code-projects Hospital Information System 1.0. Affected by this vulnerability is the function getSinglePresp of the file includes/presp/PrespController.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-04T03:17:46.500Z",
  "pubdate": "2026-09-04T03:17:46.500Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the Hospital Information System 1.0. The vulnerability resides within the getSinglePresp function in the includes/presp/PrespController.php file.\nThis flaw allows a remote, unauthenticated attacker to manipulate the 'ID' argument, leading to unauthorized execution of arbitrary SQL commands against the backend database.\nThe successful exploitation of this vulnerability can result in the full compromise of the database, including the unauthorized retrieval, modification, or deletion of sensitive patient information and administrative data.\nGiven that proof-of-concept exploit code is publicly available, the risk of exploitation is high. Organizations utilizing this version of the Hospital Information System are exposed to significant data breaches, potential regulatory non-compliance, and loss of system integrity.\nImmediate remediation is required to sanitize user-supplied input before it is processed by database queries.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located within the getSinglePresp function of the PrespController.php component in Hospital Information System 1.0.\nThe root cause of this vulnerability is the failure of the application to properly sanitize and validate the 'ID' parameter before incorporating it into a database query string. By improperly handling this input, the application remains susceptible to the injection of malicious SQL syntax through the URL request or form input.\nThe attack flow begins with a remote actor crafting a malicious request targeting the PrespController.php script. The attacker injects SQL metacharacters (such as single quotes, comments, or UNION operators) into the 'ID' parameter. Because the application processes this argument via an unsafe database call—likely a direct concatenation of the user input into the SQL statement—the database engine interprets the attacker's input as executable code rather than literal data.\nExploitation does not require prior authentication, meaning the attack is fully remotely exploitable over the network. By leveraging techniques such as error-based or union-based injection, an attacker can bypass standard application logic to extract structural information about the database schema, dump the contents of sensitive tables, or potentially escalate privileges if the database user permissions are overly permissive.\nThe post-exploitation impact is severe. Upon successful execution, the attacker gains the ability to interact with the database management system (DBMS) directly. This allows for the exfiltration of personally identifiable information (PII) or sensitive health records, the subversion of authentication mechanisms, or the manipulation of hospital operational data. As the exploit is public, the barrier to entry for malicious actors is significantly reduced, necessitating urgent architectural changes to the affected controller logic to prevent further compromise."
}