EUVD-2026-41722
GHSA-5869-jwxp-w93g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SQLi requiring low-privilege authentication (PR:L); no scope change; partial C/I/A impacts consistent with limited database access depth.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /patientorder.php. Such manipulation of the argument editid leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate the editid parameter in /patientorder.php, potentially exposing or modifying patient order records and underlying database contents. The CVSS 4.0 vector (PR:L, E:P) confirms low-privilege authentication is required and that a public exploit has been disclosed via GitHub. While the base impact metrics are rated Low across confidentiality, integrity, and availability, the sensitivity of healthcare data in scope and the trivially available proof-of-concept raise practical risk above what the numeric score alone suggests.
Technical ContextAI
The affected product is a PHP-based Hospital Management System distributed by itsourcecode.com, identified by CPE cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection pattern where user-supplied input to the editid parameter in /patientorder.php is concatenated unsanitized into a backend SQL query rather than handled via parameterized statements or prepared queries. PHP applications of this type commonly use MySQLi or PDO without bound parameters, enabling attackers to inject arbitrary SQL clauses. The wildcard CPE version field indicates NVD has not bounded the flaw to a specific version beyond the known 1.0 release.
RemediationAI
No vendor-released patch has been identified at time of analysis for Hospital Management System 1.0; given the educational nature of itsourcecode projects, an official patched release is unlikely. The primary fix is to manually remediate /patientorder.php by replacing string-concatenated SQL queries with parameterized prepared statements using PHP's PDO or MySQLi APIs - this eliminates the injection vector without functional side effects. As an immediate compensating control, restrict access to /patientorder.php and the broader application to trusted internal networks or VPN-only access, removing public internet exposure; this trades availability for a significant reduction in attack surface. A WAF rule blocking SQL metacharacters in the editid parameter can provide detection and limited blocking capability but should not be treated as a substitute for code-level remediation, as WAF bypass techniques are well-documented. Full vulnerability details are available at https://vuldb.com/vuln/376299 and the public POC at https://github.com/ltranquility/submit_vuln/issues/1.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today