Executive brief
itsourcecode Hospital Management System is a web-based platform used to manage medical appointments and patient records. A security vulnerability in the appointment management component allows logged-in users to perform unauthorized database operations. This could lead to the exposure of sensitive patient data, unauthorized modification of medical records, or disruption of hospital scheduling services.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the '/appointment.php' file. The root cause is the failure to properly sanitize or validate the 'editid' GET parameter before using it in a database query. An authenticated attacker can exploit this by sending specially crafted SQL payloads (e.g., error-based techniques using GTID_SUBSET) to manipulate queries. Successful exploitation allows for unauthorized database access, data exfiltration, and potential system control. A public proof-of-concept using sqlmap has been disclosed. Recommended remediation includes implementing prepared statements with parameter binding.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-05-27: disclosed: Initial disclosure on GitHub
- 2026-06-28: advisory: CVE published and NVD record created