Executive brief
itsourcecode Hospital Management System 1.0, a software used for managing medical facility operations, contains a security flaw in its patient order processing component. An attacker with basic user credentials can exploit this vulnerability to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive patient records, unauthorized modification of medical data, or disruption of hospital services.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the '/patientorder.php' component. The root cause is the improper neutralization of special elements in the 'editid' GET parameter, which is used in SQL queries without sufficient validation or sanitization. An authenticated attacker can perform a time-based blind SQL injection attack (e.g., using MySQL RLIKE SLEEP payloads) to extract data from the database or manipulate records. While the attack requires valid login credentials, it can be executed remotely over the network. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-06-03: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-07-05: advisory: NVD/VulDB advisory published