Hospital Management System CVE-2026-19020

Exploitation requires a valid authenticated session with at least low-privilege access to the Hospital Management System web application (PR:L per CVSS 4.0 vector). The attacker must be able to send HTTP requests to /servicetype.php, which implies the web interface is network-reachable. The vulnerable parameter is editid, passed via HTTP GET or POST to /servicetype.php. No special server-side configuration is required beyond the application being deployed and accessible. Exploitation is limited by the authentication requirement - unauthenticated external attackers cannot directly exploit this without first obtaining credentials. Impact is further limited to low confidentiality, integrity, and availability effects per CVSS 4.0 VC:L/VI:L/VA:L, with no subsequent system scope change (SC:N/SI:N/SA:N).

The CVSS 4.0 score of 2.1 (Low) reflects limited impact per metric - VC:L/VI:L/VA:L with PR:L - meaning exploitation requires authenticated access and yields only partial data access rather than full database compromise. However, the E:P threat modifier confirms a public exploit exists, which narrows the gap between theoretical and practical risk. EPSS data is not provided; given the obscure product footprint, wide exploitation is unlikely. No CISA KEV listing means active exploitation is not confirmed at time of analysis. The main real-world concern is that hospital management systems contain sensitive patient data (PII, medical records), so even limited SQL injection impact (VC:L) could carry regulatory consequences under HIPAA or equivalent frameworks. This is a genuine vulnerability but low-priority for most organizations due to the product's niche deployment base - defenders running this specific software should treat it as a real priority despite the low numeric score.

An authenticated low-privilege user (e.g., a receptionist or staff account) navigates to /servicetype.php and appends a crafted SQL payload to the editid parameter in the HTTP request, such as editid=1 UNION SELECT username,password,3 FROM users--. The injected query executes against the backend database, returning credential hashes or patient records in the application response. A public proof-of-concept exists on GitHub, making this attack accessible to low-skill actors with valid credentials.