Hospital Management System CVE-2026-16334

Exploitation requires a valid low-privilege authenticated session in the Hospital Management System (PR:L per CVSS 4.0 vector). The attacker must be able to send HTTP requests to the /prescriptionorder.php endpoint and control the editid parameter value. No special server-side configuration beyond a default installation is required - the flaw exists in the application code itself. What limits exploitation: the attacker must possess or compromise an application account (any role that can access the prescription order page); unauthenticated internet scanners cannot exploit this directly. Exploitation is constrained to the database context of the application's DB user; lateral OS-level compromise is not indicated by available data.

The CVSS 4.0 score of 5.3 (Medium) reflects constrained impact: VC:L/VI:L/VA:L with PR:L means the attacker must already be authenticated and the achievable damage is limited - read or modify data within the application's database context but no full system compromise or scope change (SC:N/SI:N/SA:N). The E:P modifier confirms a public exploit exists, which elevates practical risk above the raw score suggests for organizations running this software. However, no KEV listing means CISA has not confirmed active exploitation in the wild. EPSS data is absent from available intelligence. The realistic risk is medium for any hospital deploying this exact software: an insider threat or a compromised low-privilege account (nurse, receptionist) could abuse this to read or alter prescription records. The product's niche footprint (see prevalence) limits broad exploitation campaigns.

An authenticated user with low-privilege access (e.g., a hospital staff account) sends a crafted HTTP request to /prescriptionorder.php with a malicious editid parameter containing SQL injection syntax, such as a UNION-based payload. The unsanitized input is passed directly into a database query, allowing the attacker to extract patient records, prescription data, or credential hashes from the underlying database. A public proof-of-concept is available at https://github.com/LiamJim/cve/issues/1, which lowers the skill threshold for exploitation.