Executive brief
itsourcecode Hospital Management System is a web-based platform used for managing medical facility operations. A security flaw in the medicine management component allows logged-in users to perform unauthorized database operations. This could lead to the exposure of sensitive patient or hospital data, unauthorized modification of records, or disruption of hospital services.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the '/medicine.php' file. The root cause is the improper sanitization of the 'editid' GET parameter before its use in a SQL query. An authenticated attacker can exploit this by providing a malicious payload (e.g., using error-based techniques like GTID_SUBSET) to manipulate database queries. Successful exploitation allows for unauthorized data retrieval, modification, or deletion from the underlying MySQL database. A proof-of-concept exploit using sqlmap has been publicly disclosed.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-06-01: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-07-04: advisory: CVE published to NVD.