Executive brief
A security vulnerability exists in the itsourcecode Hospital Management System, a software platform used for managing medical records and hospital operations. An attacker with basic user credentials can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive patient information, unauthorized modification of medical records, or disruption of hospital services.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the '/patviewprescription.php' component. The application fails to properly sanitize or validate the 'delid' GET parameter before incorporating it into a database query. An authenticated attacker can provide a malicious payload (such as time-based blind SQL injection) to manipulate SQL queries. This allows for unauthorized database access, data exfiltration, and potential system control. A public proof-of-concept (PoC) using sqlmap has been disclosed. No official patch is currently documented, but remediation should involve implementing prepared statements and parameter binding.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-06-10: disclosed: Vulnerability details and PoC shared on GitHub issue tracker.
- 2026-07-13: advisory: CVE-2026-15536 published.