Hospital Management System CVE-2026-19364

Exploitation requires a valid authenticated session in the Hospital Management System - the CVSS 4.0 vector specifies PR:L, meaning any low-privilege logged-in user (receptionist, clerk, or junior clinical staff) can trigger the injection without administrative rights. The attack specifically targets the delid parameter in the /viewdoctorconsultancycharge.php script, which processes doctor consultancy charge record deletions. No special server-side configuration beyond a default deployment of version 1.0 is required. The web interface must be reachable over the network (AV:N), so unauthenticated remote exploitation is not supported by available data - an attacker must first obtain valid credentials through phishing, credential stuffing, or insider access. Impact is bounded to limited confidentiality and integrity effects (VC:L/VI:L); no availability impact is confirmed.

The CVSS 4.0 score of 2.1 reflects AV:N/AC:L/AT:N/PR:L/UI:N with limited impact (VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) and an E:P exploit maturity modifier confirming a public proof-of-concept. No CISA KEV listing exists, meaning active exploitation at scale is not confirmed. EPSS data was not provided, leaving probabilistic exploitation risk unquantified. The authentication prerequisite (PR:L) is a meaningful mitigating factor - only users with valid credentials can exploit this, reducing the threat from anonymous internet actors. However, the public PoC substantially lowers the skill threshold for any insider threat or attacker with stolen credentials. Even a mid-sized municipal IT team in opole managing a locally-deployed instance of this software should treat this as a priority remediation given healthcare data sensitivity - patient records and billing data carry regulatory and reputational risk disproportionate to the low raw CVSS score. The niche product footprint further limits mass exploitation risk, making targeted insider abuse the dominant threat model.

An attacker with a valid low-privilege account (e.g., a hospital receptionist or compromised staff credential) navigates to /viewdoctorconsultancycharge.php and submits a crafted request with a SQL payload in the delid parameter - for example, delid=1 UNION SELECT username,password,3 FROM users--. A public PoC demonstrating this technique is available at https://github.com/ltranquility/vuln_submit/issues/22. Depending on the database account's permissions, the attacker can enumerate patient records, doctor billing data, or administrative credentials stored in the application database.