EUVD-2026-41789
GHSA-rcpp-gchp-592g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible web endpoint requires a low-privilege authenticated session (PR:L); standard SQLi with no scope change yields limited and symmetric C/I/A impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /paymentdischarge.php. This manipulation of the argument patientid causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
AnalysisAI
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /paymentdischarge.php endpoint to database manipulation via the unsanitized patientid parameter. Low-privileged authenticated attackers can exploit this remotely with no user interaction required, achieving limited read, write, and availability impact against the underlying database. No public KEV listing, but a proof-of-concept exploit is publicly disclosed on GitHub, meaningfully lowering the bar for opportunistic exploitation in any internet-exposed deployment.
Technical ContextAI
The affected product is a PHP-based hospital management application distributed by itsourcecode (CPE: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*), commonly used as a demo or student project. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where the patientid parameter passed to /paymentdischarge.php is interpolated directly into a backend SQL query without parameterization or escaping. This is a classic PHP SQL injection pattern - the application likely uses unsanitized $_GET or $_POST input concatenated into a raw SQL string rather than using PDO prepared statements or MySQLi parameterized queries. The discharge payment workflow makes this endpoint likely to interact with patient billing and identity records.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor site (https://itsourcecode.com/) should be monitored for any updated release. The primary fix is to replace raw SQL string concatenation in /paymentdischarge.php with PDO prepared statements or MySQLi parameterized queries for the patientid parameter, eliminating the injection surface entirely. As a compensating control, a web application firewall rule targeting SQL metacharacters (quotes, SQL keywords, UNION/SELECT patterns) on the patientid input field can reduce exploitation success at the cost of potential false positives on numeric patient IDs containing edge-case formatting. Access to /paymentdischarge.php should be restricted to the minimum required user roles via application-level authorization checks, reducing exposure if credentials are compromised. If this system is not actively serving patients in production, taking it offline until a patched version is available is the lowest-risk posture.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today