EUVD-2026-45167
GHSA-cq83-c7ww-m93g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Pre-authentication network login-form SQLi with no user interaction; limited C/I/A impact consistent with partial database access, no scope change to other systems.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
AnalysisAI
SQL injection in the Login Form of code-projects Hospital Bed Management System 1.0 exposes unauthenticated remote attackers to database manipulation via the Username parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial, unauthenticated network exploitation with no user interaction, and the E:P modifier reflects a publicly available proof-of-concept on Gitee. While not listed in CISA KEV, the low barrier to exploitation combined with a public POC elevates practical urgency for any organization running this software, despite the product's niche footprint.
Technical ContextAI
CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause as unsanitized user-supplied input being concatenated directly into backend SQL queries rather than handled via parameterized statements or prepared queries. The affected component is the Login Form's Username field - a pre-authentication entry point, making this particularly severe as no credentials are needed to reach the vulnerable code path. The product is identified via CPE cpe:2.3:a:code-projects:hospital_bed_management_system:*:*:*:*:*:*:*:* (wildcard version), indicating all available releases of this PHP-based web application from code-projects.org are affected. The healthcare context of the application means the underlying database may contain sensitive patient and operational data.
RemediationAI
No vendor-released patch has been identified at time of analysis. The definitive fix is to refactor the Login Form's Username parameter handling to use parameterized queries or prepared statements, eliminating SQL string concatenation entirely - this resolves CWE-89 at the root. As an immediate compensating control, restrict web application access to trusted internal IP ranges or place the application behind a VPN, reducing the unauthenticated attack surface described by the AV:N vector; trade-off is reduced operational accessibility. A Web Application Firewall (WAF) rule blocking common SQL injection patterns (single quotes, UNION SELECT, inline comments) provides partial short-term mitigation but is bypassable via encoding or obfuscation and should not be treated as a permanent fix. Input validation rejecting non-alphanumeric characters in the Username field offers a secondary layer but is not a substitute for parameterized queries. Refer to the VulDB advisory at https://vuldb.com/vuln/379756 and the public POC at https://gitee.com/Ajkss/cve/issues/IJU5GU for technical reproduction details.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today