Executive brief
A security vulnerability exists in the itsourcecode Hospital Management System, a software platform used for managing medical facility operations. An attacker with basic user credentials can exploit a flaw in the prescription reporting feature to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive patient records, data tampering, or disruption of hospital services.
Technical details
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the /prescriptionorderreport.php file. The root cause is the improper neutralization of special elements in the 'delid' parameter, which is used in SQL queries without sufficient validation or parameterization. A remote attacker with low-privileged (authenticated) access can provide malicious input to manipulate database queries. Successful exploitation can lead to unauthorized data retrieval, modification, or deletion. A public exploit (PoC) involving time-based blind SQL injection has been disclosed.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-06-14: disclosed: Vulnerability details and PoC shared on GitHub repository ltranquility/submit_vuln
- 2026-07-20: advisory: CVE-2026-16244 published by VulDB/NVD