Hospital Management System CVE-2026-16244

Exploitation requires a valid low-privilege authenticated session on the Hospital Management System (confirmed by CVSS 4.0 PR:L). The /prescriptionorderreport.php endpoint must be reachable over the network (AV:N, AC:L). No special non-default configuration is needed beyond standard application access - any authenticated user who can reach the prescription order report page can supply the malicious delid parameter. Exploitation is limited by the authentication gate: unauthenticated external attackers cannot exploit this without first obtaining credentials. Additionally, the actual data exposure depends on the database account's granted permissions; a restricted DB user may limit the attacker to the application schema rather than full server compromise.

The CVSS 4.0 base score of 5.3 (Medium) reflects a network-reachable flaw with low attack complexity (AC:L, AT:N) but a meaningful barrier in the form of low-privilege authentication (PR:L). All three vulnerable-system impact metrics are rated Low (VC:L, VI:L, VA:L), suggesting partial rather than full database compromise as the baseline expectation - though in practice, SQL injection in PHP applications frequently enables full database enumeration or credential extraction depending on database user permissions. No EPSS score was provided in the input data, so exploitation probability cannot be numerically benchmarked. The E:P flag in the CVSS 4.0 environmental vector confirms a public exploit exists, which elevates real-world risk above a theoretical flaw. The absence of a KEV listing indicates no confirmed widespread active exploitation at time of analysis. Overall, this is a genuine medium-priority issue: the authentication gate and niche product footprint limit blast radius, but the public POC and network exploitability make it actionable for any organization actually running this software.

An attacker with a low-privilege account on the Hospital Management System authenticates and sends a crafted HTTP request to /prescriptionorderreport.php with a malicious value in the delid parameter - for example, appending a UNION-based or boolean-based SQL payload. A publicly available POC on GitHub (ltranquility/submit_vuln/issues/10) demonstrates this technique. Depending on database user permissions, the attacker may enumerate patient records, prescription data, or system credentials stored in the backend database.