EUVD-2026-54228
GHSA-67g8-q7qm-wc9c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible PHP endpoint requires authenticated low-privileged session (PR:L); SQL injection yields partial data read/write with no scope change or meaningful availability impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /treatmentdetail.php. Executing a manipulation of the argument patientid can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
AnalysisAI
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries by supplying crafted input via the patientid parameter in /treatmentdetail.php. Successful exploitation can result in unauthorized read or modification of patient records and other database contents. Publicly available exploit code exists (CVSS 4.0 supplemental E:P), raising practical risk above the low numeric score of 2.1 suggests; however, no confirmed active exploitation has been identified in CISA KEV at time of analysis.
Technical ContextAI
The affected application is a PHP-based Hospital Management System distributed by itsourcecode.com. CWE-74 (Injection) covers improper neutralization of special elements in output consumed by a downstream component - in this case, the patientid GET or POST parameter in /treatmentdetail.php is interpolated directly into a SQL query without sanitization, parameterization, or use of prepared statements. This permits an attacker to alter query logic (e.g., UNION-based extraction, Boolean-blind, or error-based techniques) to read or manipulate the underlying database. The treatment detail page is a data-rich target, likely querying patient records, diagnosis entries, and treatment history. No CPE string was supplied in the source intelligence; affected scope is limited to version 1.0 per ENISA EUVD-2026-54228.
RemediationAI
No vendor-released patch has been identified at the time of analysis. The vulnerability was reported through a GitHub issue (https://github.com/ltranquility/submit_vuln/issues/13) and is tracked in VulDB at https://vuldb.com/vuln/386537, but neither source references an official vendor fix or patched release version. If source code access is available, the immediate fix is to replace dynamic SQL string concatenation in /treatmentdetail.php with parameterized queries or prepared statements (PDO or MySQLi) - this eliminates the root cause with no functional side effects. As a compensating control, deploy a WAF rule to detect and block SQL injection patterns (UNION SELECT, stacked queries, Boolean payloads) targeting the patientid parameter on /treatmentdetail.php requests, noting that WAF rules can be bypassed by sufficiently obfuscated payloads. Restrict access to /treatmentdetail.php to the minimum necessary authenticated roles via application-level access controls. Enable database query logging and alert on anomalous patterns. Contact the vendor at https://itsourcecode.com/ for patch status.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today