Hospital Management System CVE-2026-19973

Exploitation requires possession of a valid low-privilege user account on the Hospital Management System, as confirmed by PR:L in the CVSS 4.0 vector - unauthenticated exploitation is not supported by available data. The attack targets the delid parameter of /viewpaymentreport.php over the network (AV:N), with no special non-default configuration required beyond a running, network-accessible instance. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning no race condition or environmental prerequisite applies. Limiting factors include: the mandatory authenticated session (even low-privilege), the niche deployment footprint of this academic PHP application, and the absence of confirmed active exploitation in the wild. The public PoC lowers the skill threshold but does not remove the authentication prerequisite.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/E:P) signals a network-exploitable flaw with low complexity and a confirmed proof-of-concept (E:P), making exploitation technically accessible to low-skilled attackers. The PR:L requirement - a valid low-privilege account - meaningfully limits unauthenticated mass exploitation. Impact metrics (VC:L/VI:L/VA:L) suggest partial data exposure and manipulation, though SQL injection primitives are frequently escalated in practice beyond their scored impact. No CISA KEV listing exists, so active widespread exploitation is not confirmed; however, the public PoC on GitHub increases the probability of opportunistic attacks against exposed instances. The product's narrow deployment footprint - a niche open-source academic project - substantially limits aggregate real-world risk compared to a similarly scored vulnerability in broadly deployed enterprise software. This is not a systemic priority but represents a real, actionable risk for any organization running this specific application.

An attacker with a low-privilege account on the Hospital Management System sends a crafted HTTP request to /viewpaymentreport.php with a SQL payload injected into the delid parameter - for example, appending boolean-based or UNION-based SQL syntax. Using the publicly available proof-of-concept at https://github.com/Fomovet/cve/issues/7 as a template, the attacker can enumerate database tables and extract sensitive patient records, billing information, or credentials stored in the backend database.