EUVD-2026-54223
GHSA-2vw3-5xf5-vwq6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible via HTTP with low-privilege authentication required (PR:L); no scope change; partial impact on all three pillars consistent with SQL injection with bounded query context.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /treatment.php. Performing a manipulation of the argument editid results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
AnalysisAI
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /treatment.php endpoint to database manipulation via the editid parameter, accessible to remote low-privilege authenticated users. Public exploit code has been released and is referenced via a GitHub issue, making exploitation straightforward for attackers who have obtained any valid session. The CVSS 4.0 score of 2.1 reflects bounded impact (low C/I/A, no subsequent-system scope), but the healthcare context - where treatment records carry regulatory and patient-safety weight - elevates real-world consequence beyond the raw score.
Technical ContextAI
The affected application is a PHP-based hospital management system distributed by itsourcecode, targeting version 1.0. The root cause is classified under CWE-74 (Injection), with SQL injection (CWE-89) as the precise sub-type: user-supplied input in the editid parameter of /treatment.php is interpolated directly into SQL queries without parameterization or adequate sanitization, allowing the interpreter to treat attacker data as SQL syntax. No CPE string was provided in source data, but the EUVD entry (EUVD-2026-54223) confirms the affected product as Hospital Management System 1.0. The PHP tag in intelligence sources confirms server-side script execution context, typical of shared-hosting or self-hosted LAMP-stack deployments common in itsourcecode demo/educational projects.
RemediationAI
No vendor-released patch has been identified at time of analysis - monitor VulDB entry https://vuldb.com/vuln/386536 and the GitHub report at https://github.com/ltranquility/submit_vuln/issues/12 for patch availability. The primary code-level fix is to replace dynamic SQL construction in /treatment.php with parameterized prepared statements for the editid parameter, eliminating the injection surface entirely. As an interim compensating control, deploy a Web Application Firewall rule blocking SQL metacharacter sequences (quotes, comment markers, UNION/SELECT keywords) in the editid parameter - note this may generate false positives for edge-case legitimate inputs. Restrict access to /treatment.php to authenticated, internal-network sessions only and enforce the principle of least privilege on the application's database user account, limiting it to only the tables and operations strictly required; this bounds the blast radius if exploitation occurs. Review all other parameter inputs in the application for the same pattern, as itsourcecode projects commonly exhibit systemic injection flaws across multiple endpoints.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today