Executive brief
A vulnerability exists in the itsourcecode Hospital Management System, a software platform used to manage medical appointments and patient records. An attacker with basic user credentials can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive patient information, unauthorized modification of medical records, or disruption of hospital operations.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the Appointment Handler component. The root cause is the improper neutralization of special elements in the 'editid' GET parameter used by the /appointmentdetail.php file. An authenticated attacker can provide a specially crafted SQL payload (e.g., error-based or boolean-based) to manipulate database queries. Successful exploitation allows for unauthorized data retrieval, modification, or deletion from the MySQL database. A public exploit (PoC) using sqlmap has been disclosed. No official patch is currently documented; remediation should involve implementing prepared statements and parameterized queries.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-05-28: disclosed: Vulnerability discovered and reported by Fomovet via GitHub issue.
- 2026-06-29: advisory: NVD and VulDB published the advisory.