Online Hospital Management System CVE-2026-10208

No special conditions - remote unauthenticated exploitation against default configurations of code-projects Online Hospital Management System. The attacker only needs network reachability to the login_1.php endpoint and the ability to submit a Username parameter to the login_user function; no valid credentials, user interaction, or non-default settings are required (CVSS PR:N/UI:N/AC:L). Limiting factors: the application is a niche PHP project typically deployed in academic or small-clinic environments rather than large hospital networks, and the MySQL backend must not be fronted by a WAF or query-sanitizing middleware. Successful data extraction beyond auth bypass also requires the database account used by the app to have read access to the targeted tables.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates the flaw is network-reachable, low-complexity, and requires no privileges or user interaction - classic conditions for opportunistic mass exploitation. However, the C:L/I:L/A:L impact scoring is low for each dimension, yielding an overall 7.3 (High but not Critical); the Exploit Code Maturity (E:P) and Report Confidence (RC:R) qualifiers indicate a proof-of-concept exists and the report is reasonable rather than fully confirmed. EPSS score, KEV status, and SSVC decision values were not provided in the input, so automated-exploitation probability cannot be quantified. Real-world risk depends heavily on exposure: code-projects software is typically used in academic, training, or small-clinic contexts rather than enterprise production, so blast radius is usually narrow, but any internet-exposed instance should be treated as imminently exploitable given the public PoC.

An unauthenticated attacker discovers a publicly exposed Online Hospital Management System login page via Shodan or Google dorking and submits a crafted POST request to login_1.php with a malicious Username payload such as ' OR 1=1-- to bypass authentication or extract patient records via UNION-based injection. Using the publicly available PoC at github.com/Mi0uno/Online-Hospital-Management-System-has-SQL-Injection, the attacker enumerates the database, exfiltrates PHI/PII, and potentially escalates to writing a webshell via INTO OUTFILE if MySQL file privileges permit.