Hospital Management System CVE-2026-19347

Exploitation requires the attacker to hold at minimum a low-privileged authenticated session on the Hospital Management System web interface, as confirmed by the CVSS 4.0 PR:L metric. The specific attack surface is the delid parameter in HTTP requests directed at /viewdoctor.php; this endpoint must be reachable by the attacker's session role. No special non-default configuration, plugin, or deployment mode is required - the vulnerability is present in the default application logic. What limits exploitation: attackers without valid credentials cannot directly reach the vulnerable parameter (PR:L excludes unauthenticated external attackers), and scope change is absent (SC:N/SI:N/SA:N), meaning lateral movement to other systems via this flaw alone is not indicated by available data.

Real-world risk is moderate despite the mid-range score of 5.3. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms straightforward network exploitation with no complexity barriers once an attacker holds a low-privilege account. Impact is bounded - VC:L/VI:L/VA:L with no subsequent-system impact (SC/SI/SA:N) - suggesting partial data exposure rather than full database takeover, though actual depth depends on the MySQL/database user's privilege level, which is unconfirmed in the available data. The E:P supplemental metric in the provided CVSS 4.0 vector explicitly flags an existing public PoC, which elevates practical exploitation likelihood above the base score implies. EPSS data was not supplied; KEV status is absent, indicating no confirmed mass exploitation. The primary risk amplifier is the healthcare context: even limited SQL read access to a hospital system can expose protected health information (PHI), triggering regulatory liability under frameworks such as HIPAA. CVSS reflects 'low' impacts per metric, but the sensitivity of the data class makes this higher-consequence than a comparable SQLi in a generic web app.

An attacker who has obtained a low-privilege account on the Hospital Management System - through phishing, credential stuffing, or a shared staff login - sends a crafted HTTP GET or POST request to /viewdoctor.php with a malformed delid value such as 1 UNION SELECT username,password,3 FROM users--. A public proof-of-concept demonstrating this technique is available at https://github.com/ltranquility/submit_vuln/issues/17. Depending on the database user's privileges, the attacker can extract physician and patient records, enumerate table schemas, or alter records to disrupt clinical workflows.