Executive brief
A Hospital Management System web application contains a SQL injection vulnerability in its search functionality. Attackers can manipulate the Contact parameter to execute arbitrary SQL queries against the database, potentially leading to unauthorized access to patient records, medical data, or other sensitive healthcare information.
Technical details
The vulnerability is a SQL injection flaw in the /search.php file of Hospital-Management-System version 1.0. The Contact parameter is directly incorporated into SQL queries without proper input validation or parameterized prepared statements. An attacker can craft malicious input to break out of the intended SQL query and execute arbitrary database commands. The attack is network-accessible and requires no authentication or user interaction. Successful exploitation allows attackers to read, modify, or delete database records. No patch has been made available; the vendor did not respond to early disclosure attempts.
Affected products
- kishan0725 Hospital-Management-System 1.0
Timeline
- 2026-08-31: disclosed
- exploited: exploit released to public