Executive brief
A security vulnerability exists in the itsourcecode Hospital Management System, a software platform used for managing patient records and hospital operations. An attacker with basic user access can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive patient information, data tampering, or disruption of hospital services.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the '/paymentdischarge.php' file. The root cause is the improper neutralization of special elements in the 'patientid' GET parameter, which is used in SQL queries without sufficient sanitization or prepared statements. An attacker with valid low-privileged credentials can provide a malicious payload (such as error-based EXTRACTVALUE sequences) to manipulate database queries. Successful exploitation can lead to unauthorized data retrieval, modification, or deletion. A public exploit involving sqlmap has been disclosed.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-06-06: disclosed: Vulnerability reported on GitHub by ltranquility.
- 2026-07-05: advisory: CVE-2026-14774 published.