Hospital Management System CVE-2026-16131

Exploitation requires a valid authenticated session with at least low-privilege access to the Hospital Management System - the CVSS 4.0 PR:L metric confirms this. The attack targets the delid parameter submitted to /prescriptionrecord.php, which must be reachable by the authenticated user's role. No non-default configuration, special server setup, or elevated OS-level access is required beyond standard application deployment. Exploitation is limited by: (1) the authentication barrier - unauthenticated external attackers cannot exploit this without first obtaining credentials through phishing, credential stuffing, or other means; and (2) the scope of the injection being tied to the prescription record deletion flow, which may limit what database tables are reachable depending on query construction.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) confirms network-accessible exploitation with low attack complexity and no special attack requirements, but requires low privileges (PR:L) - meaning an attacker must already hold a valid account. The E:P tag in the CVSS vector is consistent with the confirmed public POC on GitHub, reducing the skill threshold substantially. The score of 5.3 reflects constrained impact scope (all VC/VI/VA at L, no subsequent-system impact), which likely reflects the bounded nature of a delete-parameter injection rather than a full blind or UNION-based injection chain. This vulnerability is not listed in CISA KEV, so mass exploitation is not confirmed. However, the sensitivity of hospital data - patient records, prescriptions - means even low-confidence data leakage carries disproportionate real-world harm. The primary limiting factor is the authentication requirement, which narrows the attacker pool to insiders or previously compromised accounts.

An attacker with a low-privilege account in the Hospital Management System - such as a receptionist or student intern - submits a crafted HTTP request to /prescriptionrecord.php?delid=1 OR 1=1--, injecting SQL that bypasses intended query logic. With public exploit code available at https://github.com/ltranquility/submit_vuln/issues/9, the attacker can enumerate the database schema or extract prescription records without elevated application privileges. The attack requires no special tooling beyond a browser or curl, given the low complexity and available POC.