Executive brief
A vulnerability exists in the itsourcecode Hospital Management System, a software platform used for managing patient records and appointments. An attacker with basic user credentials can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive patient information, unauthorized modification of medical records, or disruption of hospital operations.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the 'patientappointment.php' component. The root cause is the improper neutralization of special elements in the 'patiente' POST parameter, which is used in SQL queries without sufficient sanitization or parameterization. An authenticated attacker can exploit this by sending a specially crafted POST request (e.g., using error-based payloads like EXTRACTVALUE) to execute arbitrary SQL commands. This allows for unauthorized database enumeration, data extraction, and potential modification of records. The exploit has been publicly disclosed via a GitHub issue including a Proof of Concept (PoC) using sqlmap.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-06-03: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-07-04: advisory: NVD/VulDB advisory published