Executive brief
A security vulnerability exists in the itsourcecode Hospital Management System, a software platform used for managing medical facility operations. An attacker with basic user credentials can exploit this flaw to access or modify sensitive database information. This could lead to the exposure of patient records, unauthorized changes to hospital data, or disruption of medical services.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the '/department.php' component. The root cause is the failure of the application to properly sanitize or validate the 'editid' GET parameter before using it in a database query. An attacker with low-privileged authenticated access can provide a malicious payload (e.g., using error-based techniques like GTID_SUBSET) to manipulate SQL queries. Successful exploitation allows for unauthorized database access, data leakage, and potential system control. A public exploit (PoC) using sqlmap has been released.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-05-28: disclosed: Vulnerability discovered and reported by Fomovet via GitHub issue.
- 2026-06-29: advisory: CVE-2026-13531 published to the NVD.