Hospital Management System CVE-2026-19767

Exploitation requires a valid low-privilege user account in the Hospital Management System - the CVSS 4.0 vector specifies PR:L (low privileges required), confirming authentication is a prerequisite; unauthenticated remote exploitation is not possible. The attacker must have HTTP or HTTPS network access to the web application interface. The specific vulnerable endpoint is viewdoctortimings.php and the injection point is the delid request parameter. No special server-side configuration, non-default feature flag, or elevated database permission is needed beyond a default installation of version 1.0. Exploitation is bounded by the authentication requirement: an attacker must first obtain or self-register a valid account before issuing the malicious request. No user interaction from a privileged user is required once an account is held.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with a reported overall score of 2.1 reflects low impact metrics (VC:L/VI:L/VA:L) assigned by the VulDB reporter, but this likely underestimates realistic impact. SQL injection in a healthcare management application exposes personally identifiable and protected health information from the database; a high confidentiality rating is more appropriate for this vulnerability class. The attack is network-accessible (AV:N), requires no complexity or special conditions (AC:L/AT:N), and needs only a low-privilege authenticated session (PR:L), making exploitation straightforward once an account is obtained. No EPSS score was provided in the available data, so probabilistic exploitation probability cannot be numerically assessed. The vulnerability is not listed in the CISA KEV catalog, confirming no verified mass exploitation campaign. However, a public proof-of-concept on GitHub lowers the skill threshold significantly. The single meaningful limiting factor is the PR:L authentication requirement, which prevents fully unauthenticated remote exploitation. For deployments with public-facing login portals - common in small clinic or hospital environments - this is a realistically exploitable issue.

An attacker who has registered or obtained a low-privileged account in the Hospital Management System authenticates and navigates to viewdoctortimings.php, appending a SQL injection payload to the delid parameter (e.g., delid=1 UNION SELECT username,password,3 FROM users--). Because the parameter is concatenated directly into the SQL query without sanitization, the attacker can enumerate all database tables and exfiltrate patient records, physician schedules, and stored credentials. A public proof-of-concept on GitHub (https://github.com/funw1n/CVE/issues/1) demonstrates this technique, further reducing the expertise required.