Executive brief
A vulnerability exists in the itsourcecode Hospital Management System, a software platform used for managing medical facility operations. An attacker with basic user credentials can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive patient records, data tampering, or disruption of hospital services.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the '/patientlogin.php' component. The root cause is the improper neutralization of special elements in the 'loginid' POST parameter, which is used in SQL queries without sufficient sanitization or parameterization. An attacker with valid low-privileged credentials can perform time-based blind SQL injection to extract sensitive information from the database or manipulate records. A public proof-of-concept using sqlmap has been disclosed, demonstrating the vulnerability against MySQL databases. No official patch is currently documented, but remediation should involve implementing prepared statements and input validation.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-06-04: disclosed: Vulnerability details and PoC shared on GitHub by ltranquility
- 2026-07-05: advisory: NVD/VulDB advisory published