Hospital Management System CVE-2026-19934

Exploitation requires an authenticated session with at least low-privilege access to the Hospital Management System web application - the CVSS PR:L metric confirms this. The attacker must be able to send HTTP requests to the /vieworder.php endpoint over the network (AV:N), meaning the application must be network-accessible. No special configuration beyond a running instance of version 1.0 is required; the vulnerable parameter appears to be a standard feature of the order management workflow. Limiting factors: an unauthenticated attacker cannot directly exploit this without first obtaining valid credentials; and exploitation impact is bounded to the application's database user privileges (VA:L, VC:L, VI:L in the 4.0 vector). No interaction from another user is required (UI:N).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) places this at 5.3, reflecting a low-complexity network-exploitable flaw requiring only low-privilege authentication with no user interaction. Impact is rated low across confidentiality, integrity, and availability on the vulnerable system, and no subsequent-system impact is assessed. EPSS data is absent from the provided intelligence, but the E:P (proof of concept) exploitability modifier confirms public exploit code exists - a meaningful escalation from theoretical risk. No KEV listing means active exploitation is not confirmed by CISA, though the gap between POC publication and observed exploitation is often narrow for simple SQLi against PHP applications. The CVSS score of 5.3 may understate operational risk in healthcare environments where patient record integrity and confidentiality carry regulatory weight (HIPAA, GDPR): even low-rated data exposure in a hospital context carries disproportionate consequence. The low PR requirement is the primary exploitation limiter - an attacker must hold some authenticated session before exploiting the injection.

An attacker with a valid low-privilege session (e.g., a hospital staff account or a credential obtained through credential stuffing) crafts a malicious HTTP request to /vieworder.php with a SQL payload injected into the delid parameter. Because the parameter is passed unsanitized into a SQL query, the injected syntax alters query logic, potentially dumping sensitive patient or order records from the database. A public proof-of-concept on GitHub lowers the skill barrier for this attack significantly.