Executive brief
A security vulnerability exists in the itsourcecode Hospital Management System, a software platform used for managing patient records and hospital operations. An attacker with basic user credentials can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive patient information, data tampering, or disruption of hospital services.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the '/patientdetail.php' component. The root cause is the application's failure to properly sanitize or validate the 'editid' GET parameter before using it in a database query. An authenticated attacker can exploit this by submitting crafted SQL payloads (including error-based and time-based blind techniques) to manipulate queries. Successful exploitation allows for unauthorized database access, data exfiltration, and potential system control. A public exploit (PoC) using sqlmap has been released. Recommended mitigations include implementing prepared statements with parameter binding and strict input validation.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-05-30: disclosed: Vulnerability details and PoC shared on GitHub issue tracker
- 2026-06-29: advisory: CVE-2026-13578 published by NVD/VulDB