EUVD-2026-41738
GHSA-h4r5-gcx6-7fx2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SQLi requiring authenticated low-privilege access (PR:L); partial confidentiality and integrity impact against patient data, no meaningful availability impact from standard injection.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /patientprofile.php. Performing a manipulation of the argument patientname results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
AnalysisAI
SQL injection in itsourcecode Hospital Management System 1.0 exposes the patient database to authenticated low-privilege attackers via the patientname parameter in /patientprofile.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms network-accessible exploitation with no attack complexity, while the E:P supplemental metric confirms publicly available proof-of-concept exploit code. No vendor patch has been released, leaving deployments reliant on compensating controls; however, real-world risk is bounded by the product's extremely limited production footprint as an educational PHP project.
Technical ContextAI
The affected application is a PHP-based hospital management system distributed by itsourcecode.com, a site primarily publishing tutorial and educational codebases. The vulnerability exists in /patientprofile.php, where the patientname HTTP parameter is incorporated into a database query without sanitization or parameterization - a textbook failure to use prepared statements on a PHP/MySQL stack. The root cause maps to CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, Injection), the parent class covering SQL injection. No CPE string was provided in the available data, but the affected product and version are explicitly identified as Hospital Management System 1.0 from itsourcecode.com.
RemediationAI
No vendor-released patch has been identified at time of analysis. The definitive fix is to refactor /patientprofile.php to use PHP PDO or MySQLi prepared statements with bound parameters for the patientname input, eliminating the injection point entirely; this is a code-level change and carries no operational side effects. As a compensating control pending code remediation, deploying a Web Application Firewall with SQL injection detection signatures (e.g., ModSecurity with the OWASP Core Rule Set) can detect and block common injection payloads - note this may introduce latency and false positives on legitimate complex queries. Restricting the application's database account to SELECT and minimal DML privileges (removing DROP, ALTER, FILE permissions) limits the blast radius of any successful injection. Whitelist-based input validation on patient name fields (allowing only alphabetic characters and common name punctuation) provides additional defense in depth but must not substitute for parameterized queries. References: https://github.com/ltranquility/submit_vuln/issues/3 and https://vuldb.com/vuln/376312.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today