Executive brief
A vulnerability exists in the itsourcecode Hospital Management System, a software platform used for managing medical facility operations. An attacker with administrative credentials can exploit this flaw to perform unauthorized database operations. This could lead to the exposure of sensitive patient data, tampering with medical records, or disruption of hospital services.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the '/adminprofile.php' file. The root cause is the improper sanitization of the 'loginid' POST parameter before it is used in a SQL query. An authenticated attacker with high privileges (admin) can send a specially crafted request to trigger error-based SQL injection (e.g., using EXTRACTVALUE). Successful exploitation allows for unauthorized database access, data exfiltration, and potential system control. A public proof-of-concept (PoC) using sqlmap has been disclosed.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-05-27: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-06-28: advisory: NVD and VulDB publish advisory details