Description

A vulnerability was found in code-projects Hospital Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /HIS/his.sql of the component SQL Database Backup File Handler. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-07T13:20:39.420Z",
  "pubdate": "2026-09-07T13:20:39.420Z",
  "executiveSummary": "A critical information disclosure vulnerability has been identified in the Hospital Information System 1.0, specifically residing within the SQL Database Backup File Handler component.\nThe vulnerability allows remote, unauthenticated attackers to gain unauthorized access to sensitive information stored within the system's database backup files, represented by the file path /HIS/his.sql.\nThe flaw stems from improper access control mechanisms governing access to database backup files, which are publicly reachable via the web server.\nThe impact is significant, as successful exploitation results in the exposure of potentially sensitive patient data, credentials, or system configuration details contained within the SQL dump.\nGiven that public exploit code is available, the risk to organizations deploying this software is high. Attackers do not require specialized authentication or elevated privileges to retrieve the file, making this a low-complexity remote attack vector that should be addressed immediately.",
  "technicalDetails": "The vulnerability resides within the SQL Database Backup File Handler component of the Hospital Information System 1.0. The root cause is a lack of restrictive access control or inadequate security configuration on the web server directory where database backups are stored.\nSpecifically, the file located at /HIS/his.sql is directly accessible via an HTTP GET request without requiring the user to authenticate or hold specific application-level privileges.\nThe attack flow is straightforward: an attacker identifies the target server running the vulnerable Hospital Information System 1.0. By crafting a simple web request to the URI path /HIS/his.sql, the web server responds by serving the content of the SQL database backup file directly to the requester.\nSince the file is an SQL dump, it likely contains the entirety of the database structure and records, including table schemas, administrative credentials, patient health information (PHI), and internal application configurations.\nBecause this file is exposed to the public internet, no specialized exploit payload is required beyond basic HTTP communication. The exposure occurs because the application developer or administrator failed to prevent public web access to the internal directory or failed to implement authorization checks to verify the requester's identity before serving sensitive static files.\nPost-exploitation, an attacker can parse the contents of his.sql to perform reconnaissance on the database schema, harvest administrative credentials to facilitate further unauthorized access to the application backend, or exfiltrate private medical records, leading to a complete compromise of data confidentiality."
}