Executive brief
A vulnerability exists in the itsourcecode Hospital Management System, a software platform used for managing medical facility operations. An attacker with basic user credentials can exploit a flaw in the appointment approval process to access or modify sensitive database information. This could lead to the exposure of patient records, unauthorized changes to medical appointments, or disruption of hospital administrative services.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the Appointment Handler component. The root cause is the improper sanitization of the 'editid' GET parameter in the /appointmentapproval.php file. An authenticated attacker can provide malicious SQL payloads (such as error-based injection using GTID_SUBSET) to manipulate database queries. Successful exploitation allows for unauthorized database access, data exfiltration, and potential system control. The vulnerability is exploitable remotely but requires valid login credentials. A public exploit using sqlmap has been disclosed.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-05-27: disclosed: Initial disclosure on GitHub by ltranquility
- 2026-06-29: advisory: NVD publication date