Executive brief
A security vulnerability exists in the itsourcecode Hospital Management System, a software platform used by medical facilities to manage patient and doctor records. An attacker with basic user credentials can exploit this flaw to interfere with the underlying database. This could lead to unauthorized access to sensitive medical data, information leakage, or disruption of hospital operations.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the '/doctorprofile.php' file. The root cause is the improper neutralization of special elements in the 'doctorname' POST parameter, which is used in SQL queries without sufficient sanitization or prepared statements. An authenticated attacker can provide a malicious payload (e.g., using error-based techniques like EXTRACTVALUE) to manipulate database queries. This allows for unauthorized data extraction, tampering, or full database compromise. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-05-29: disclosed: Initial disclosure on GitHub issue tracker
- 2026-06-29: advisory: NVD and VulDB advisory published