Executive brief
A security vulnerability exists in the Online Hospital Management System, a web application used for managing medical facility operations. An attacker can exploit this flaw to bypass the login screen and gain unauthorized access to the system, including administrative accounts. This could lead to the theft of sensitive patient data, unauthorized modification of hospital records, or a complete takeover of the management platform.
Technical details
A SQL injection vulnerability exists in the `login_user` function within `login_1.php` of the Online Hospital Management System. The vulnerability is caused by the improper neutralization of the `Username` parameter (sent via HTTP POST), which is directly concatenated into a SQL query string without sanitization or the use of prepared statements. A remote, unauthenticated attacker can exploit this by submitting malicious SQL payloads in the username field to bypass authentication logic, log in as an administrator, or extract sensitive information from the database using UNION-based or time-based blind injection techniques. Public exploits (POCs) are available, demonstrating both universal login bypass and database credential dumping.
Affected products
- code-projects Online Hospital Management System 1.php 1.0
Timeline
- 2026-05-31: disclosed: Initial discovery and public POC published on GitHub
- 2026-06-01: advisory: CVE-2026-10208 published