EUVD-2026-41786
GHSA-w3wq-fqhg-rfgv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SQLi requires a valid low-privilege session (PR:L); partial read/write DB impact applies but no meaningful availability disruption for a payment parameter injection.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /payment.php. The manipulation of the argument patientid results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
AnalysisAI
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /payment.php endpoint to database manipulation via an unsanitized patientid parameter, exploitable by any authenticated low-privilege user over the network. The CVSS 4.0 vector (PR:L, AV:N) confirms remote exploitation is feasible with only a basic account, and partial confidentiality, integrity, and availability impact is expected against the underlying database. Publicly available exploit code exists on GitHub, materially lowering the skill threshold for exploitation despite the moderate 5.3 CVSS score.
Technical ContextAI
The affected product is a PHP-based hospital management application distributed by itsourcecode (CPE: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*), a code-sharing and tutorial platform targeting student or hobbyist developers. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the patientid parameter submitted to /payment.php is interpolated directly into a backend SQL query without parameterization or escaping, a classic failure pattern in PHP applications that do not use PDO prepared statements or equivalent. The CPE wildcard on version indicates all distributed versions are likely affected. The backend database is almost certainly MySQL or MariaDB given the PHP/itsourcecode stack.
RemediationAI
No vendor-released patch has been identified at time of analysis. Itsourcecode operates as a code-sharing and tutorial platform rather than a commercial software vendor, making a formal patched release unlikely in the near term. The definitive fix is to refactor /payment.php to use parameterized queries via PHP PDO or MySQLi prepared statements for the patientid parameter, eliminating the injection surface entirely. As a compensating control, deploying a Web Application Firewall with SQLi detection rules (e.g., ModSecurity with the OWASP CRS) can block or alert on exploitation attempts at the network layer, though WAF bypass techniques exist for SQLi and this is not a substitute for code-level remediation. Restricting access to the application to trusted internal networks or a VPN reduces the AV:N attack surface and raises the bar for exploitation, given that the CVSS PR:L requirement already limits unauthenticated access. The VulDB disclosure is available at https://vuldb.com/vuln/376363 and the public exploit reference is at https://github.com/ltranquility/submit_vuln/issues/5.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today