Executive brief
code-projects Hospital Information System is a web-based healthcare management application that processes patient and medical data. A SQL injection vulnerability in the search functionality allows unauthenticated attackers to directly access and manipulate the underlying database, potentially exposing sensitive patient information, modifying medical records, or disrupting hospital operations.
Technical details
A SQL injection vulnerability exists in the findBySearch function within addReq.php (and also reported in PrespController.php) due to unsanitized user input in the 'search' parameter. The search parameter is concatenated directly into SQL queries without prepared statements or input validation, allowing attackers to inject arbitrary SQL code. The vulnerability is remotely exploitable without authentication and has been publicly disclosed with working proof-of-concept payloads (boolean-based blind, error-based, time-based blind, and UNION-based SQLi techniques). An attacker can extract database contents, modify data, or execute arbitrary queries depending on database permissions and MySQL version.
Affected products
- code-projects Hospital Information System 1.0
Timeline
- 2026-07-18: disclosed
- 2026-09-04: advisory