Executive brief
A security vulnerability exists in the SourceCodester Hospital's Patient Records Management System, a software used to manage medical patient data. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could lead to the theft of sensitive patient records, unauthorized modification of medical data, or a complete disruption of the system's operations.
Technical details
A SQL injection vulnerability exists in SourceCodester Hospital's Patient Records Management System 1.0 within the '/classes/Master.php' file. The 'save_patient' function (triggered by the 'f' parameter) fails to properly sanitize or validate the 'id' parameter before using it in a database query. A remote, unauthenticated attacker can exploit this by sending a specially crafted POST request containing malicious SQL payloads, such as boolean-based blind injection. Successful exploitation allows for unauthorized database access, data exfiltration, and potential full system compromise. A public exploit (PoC) has been released.
Affected products
- SourceCodester Hospital's Patient Records Management System 1.0
Timeline
- 2026-05-22: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-06-08: advisory: NVD/VulDB advisory published