Executive brief
itsourcecode Hospital Management System is a web-based application for managing patient records in healthcare facilities. A SQL injection vulnerability in the patient viewing module allows authenticated attackers to execute arbitrary database queries, potentially exposing sensitive patient data, modifying medical records, or disrupting service availability.
Technical details
A SQL injection vulnerability exists in the /viewpatient.php file of Hospital Management System 1.0, specifically in the "delid" parameter. The application fails to sanitize or validate user input before incorporating it into SQL queries. An authenticated attacker can inject malicious SQL code through this parameter to manipulate database queries, bypass security controls, and access or modify data. The vulnerability is remotely exploitable over the network; valid login credentials are required as a precondition. An attacker can achieve unauthorized database access, data exfiltration, data manipulation, or potential remote code execution depending on database configuration. No official patch is currently documented; remediation requires implementing prepared statements and input validation.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-06-29: disclosed: Vulnerability disclosed on GitHub issue #6
- 2026-08-17: advisory: CVE-2026-19972 published in NVD