Executive brief
A security vulnerability exists in the itsourcecode Hospital Management System, a software platform used for managing medical facility records. An attacker with basic user credentials can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive patient information, unauthorized modification of medical records, or disruption of hospital operations.
Technical details
A SQL injection vulnerability exists in the itsourcecode Hospital Management System 1.0 within the /insertbillingrecord.php component. The root cause is the improper neutralization of special elements in the 'patientid' GET parameter, which is used in SQL queries without sufficient sanitization or parameterization. An attacker with low-privileged authenticated access can exploit this via boolean-based, error-based, or time-based blind injection techniques. Successful exploitation allows for unauthorized database queries, potentially leading to data exfiltration or tampering. A public proof-of-concept using sqlmap has been disclosed.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-06-01: disclosed: Vulnerability details and PoC shared on GitHub by ltranquility.
- 2026-06-29: advisory: NVD/VulDB advisory published.