Executive brief
A security vulnerability exists in the itsourcecode Hospital Management System, a software platform used for managing medical records and prescriptions. An attacker with basic user credentials can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive patient information, unauthorized modification of medical records, or disruption of hospital operations.
Technical details
A SQL injection vulnerability exists in the itsourcecode Hospital Management System 1.0 within the '/prescription.php' component. The application fails to properly sanitize or validate the 'editid' GET parameter before using it in a SQL query. An attacker with valid low-privileged credentials can exploit this by providing a malicious payload (e.g., time-based blind SQLi) to manipulate database queries. Successful exploitation can lead to unauthorized data extraction, modification, or deletion. A public exploit (PoC) using sqlmap has been released. Developers are advised to implement prepared statements and parameter binding to mitigate this issue.
Affected products
- itsourcecode Hospital Management System Project In PHP 1.0
Timeline
- 2026-06-16: disclosed: Initial discovery and report on GitHub by shohatmedhat535-dotcom
- 2026-07-22: advisory: NVD and VulDB published the advisory