Executive brief
itsourcecode Hospital Management System is a web-based application used to manage hospital operations including patient records and payments. A SQL injection vulnerability in the payment report viewing functionality allows authenticated attackers to manipulate database queries by injecting malicious code, potentially exposing sensitive patient and financial data, altering records, or disrupting system availability.
Technical details
The vulnerability is a SQL injection flaw in the /viewpaymentreport.php file where the 'delid' parameter is not properly sanitized before being used in SQL queries. An authenticated user can inject malicious SQL code through this parameter to manipulate query logic and access or modify unauthorized database content. The attack requires valid login credentials and network access to the application. An attacker can exploit this to extract sensitive data, modify records, bypass authorization controls, or potentially execute system-level commands depending on database permissions. The vendor should implement prepared statements with parameterized queries and strict input validation to prevent injection attacks.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-06-29: disclosed: Vulnerability disclosed on GitHub
- 2026-08-17: advisory: CVE-2026-19973 published