Hospital Management System CVE-2026-75088

Exploitation requires a valid authenticated low-privileged user account within the Hospital Management System (CVSS PR:L confirmed). The specific injection point is the delid parameter of the /viewbilling.php endpoint. No special non-default server configuration is required - the vulnerability is present in the default installation of version 1.0. Unauthenticated external attackers cannot exploit this directly without first obtaining credentials. Exploitation is further limited by the low CIA impact scores, indicating partial rather than full database access or control. The delid parameter name suggests it controls a delete operation, meaning manipulation could corrupt or destroy billing records in addition to enabling data extraction.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-accessible exploitation with low attack complexity, no attack requirements, and no user interaction, but requires a low-privileged authenticated session - meaning the attack surface is limited to credentialed users. The scored value of 2.1 reflects limited (L/L/L) CIA impact, consistent with partial data access and manipulation rather than full database compromise. No EPSS score was provided in the input data, so exploitation probability cannot be quantified independently. CISA KEV status is absent, meaning active exploitation by threat actors is not confirmed at time of analysis. However, the E:P supplemental metric in the provided CVSS 4.0 vector confirms a public proof-of-concept exists, which materially lowers the skill threshold for exploitation. The product has a narrow deployment footprint as a niche open-source PHP application, which limits aggregate exposure - but any organization running it handles sensitive patient billing data, making even limited SQL injection a meaningful risk that should be addressed promptly regardless of the low numeric score.

A publicly available proof-of-concept exists at https://github.com/CSDVi/cve/issues/1. An attacker with a valid low-privileged account logs into the Hospital Management System and sends a crafted HTTP request to /viewbilling.php with a SQL payload injected into the delid parameter, causing the backend PHP application to pass unsanitized input to the database engine and enabling unauthorized read, modification, or deletion of billing records.