Executive brief
The itsourcecode Hospital Management System is a web-based application used to manage hospital operations including patient records and service management. A SQL injection vulnerability in the service type management feature allows authenticated attackers to manipulate the database by injecting malicious SQL code, potentially leading to unauthorized access to sensitive patient data, data modification, or complete system compromise.
Technical details
A SQL injection vulnerability exists in the /viewservicetype.php file of Hospital Management System v1.0, where the 'delid' parameter is not properly sanitized before being used in SQL queries. The vulnerability is reachable to any authenticated user who can access the vulnerable endpoint. An attacker can inject arbitrary SQL code through the 'delid' parameter (e.g., using UNION-based or time-based blind SQLi techniques) to read, modify, or delete database records. The root cause is the lack of input validation and the non-use of prepared statements. Remediation requires implementing prepared statements with parameter binding, strict input validation, and adherence to least-privilege database account permissions.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-07-07: disclosed
- 2026-08-23: advisory