Executive brief
A security vulnerability exists in the itsourcecode Hospital Management System, a software platform used for managing patient records and hospital operations. An attacker with basic user credentials can exploit a flaw in the patient registration component to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive patient information, unauthorized modification of medical records, or disruption of hospital services.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the '/addpatient.php' component. The root cause is the improper sanitization of the 'admissiontme' POST parameter before it is used in a database query. An authenticated attacker can exploit this by submitting specially crafted SQL payloads, including error-based and time-based blind injection techniques. Successful exploitation allows for unauthorized database enumeration, data extraction, and potential modification of records. A public exploit (PoC) using sqlmap has been disclosed. No official patch is currently documented; remediation should involve implementing prepared statements and parameterized queries.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-05-23: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-06-08: advisory: CVE published and indexed by NVD/VulDB