Executive brief
Hospital Information System is a PHP-based web application for managing hospital operations and patient data. An SQL injection vulnerability in the patient prescription controller allows unauthenticated attackers to inject malicious SQL queries via the ID parameter, enabling unauthorized database access, data theft, modification, or deletion, and potential complete system compromise.
Technical details
A SQL injection vulnerability exists in the PrespController.php file of Hospital Information System 1.0, specifically in the getSinglePresp function. The vulnerable 'id' parameter is inserted directly into SQL queries without proper input validation or parameterized query protection. An attacker can supply crafted SQL payloads (boolean-based blind, error-based, time-based blind, or UNION-based SQL injection) to extract, modify, or delete database records. No authentication is required to exploit this vulnerability, and the attack vector is remote via HTTP GET or POST parameters. Prepared statements and input validation are required to remediate the issue.
Affected products
- code-projects Hospital Information System 1.0
Timeline
- 2026-07-18: disclosed: Vulnerability reported on GitHub
- 2026-09-04: advisory: CVE-2026-85399 published