Executive brief
The itsourcecode Hospital Management System, a web application used for managing medical facility operations, contains a security vulnerability in its password management component. An attacker with basic user credentials can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive patient records, tampering with medical data, or disruption of hospital services.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the '/doctorchangepassword.php' endpoint. The root cause is the improper neutralization of special elements in the 'newpassword' POST parameter, which is used directly in SQL queries without sufficient sanitization or parameterization. An authenticated attacker (e.g., a user with doctor-level access) can send crafted SQL commands to perform time-based blind injection. Successful exploitation allows for unauthorized database enumeration, data exfiltration, and potential administrative bypass. A public exploit (POC) using the BENCHMARK function has been disclosed.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-05-29: disclosed: Initial vulnerability report on GitHub
- 2026-06-29: advisory: NVD publication date