Executive brief
A security vulnerability exists in the SourceCodester Hospital's Patient Records Management System, a web application used for managing medical patient data. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could lead to the theft of sensitive patient records, data tampering, or a complete system shutdown, significantly impacting healthcare operations and patient privacy.
Technical details
A SQL injection vulnerability exists in SourceCodester Hospital's Patient Records Management System 1.0 within the '/admin/patients/manage_history.php' file. The root cause is the improper neutralization of the 'id' GET parameter, which is used directly in SQL queries without sufficient validation or sanitization. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests (e.g., time-based blind payloads) to manipulate database queries. Successful exploitation allows for unauthorized data retrieval, modification, or deletion from the database. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- SourceCodester Hospital's Patient Records Management System 1.0
Timeline
- 2026-04-25: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-05-24: advisory: CVE-2026-9356 published.