Executive brief
itsourcecode Hospital Management System is a web-based platform used for managing medical records and administrative tasks. A security flaw in the administrative accounting module allows an attacker with basic user credentials to manipulate database queries. This could lead to unauthorized access to sensitive patient data, information leakage, or disruption of hospital operations.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the /adminaccount.php component. The root cause is the improper sanitization of the 'date' GET parameter before its use in a MySQL query. An authenticated attacker can exploit this by sending specially crafted HTTP requests containing SQL commands (e.g., time-based blind payloads). Successful exploitation allows for unauthorized database access, data exfiltration, and potential system compromise. A public proof-of-concept using sqlmap has been disclosed. No official patch is currently documented; users are advised to implement prepared statements and input validation.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-05-23: disclosed: Initial vulnerability report on GitHub
- 2026-06-08: advisory: NVD/VulDB publication date