Hospital Management System CVE-2026-76991

Exploitation requires a valid low-privilege authenticated session within the hospital management system, as confirmed by the CVSS 4.0 PR:L metric - unauthenticated remote attackers cannot exploit this without first obtaining credentials. The vulnerable endpoint is specifically /viewappointmentapproved.php and the injection point is the delid parameter; only this specific endpoint and parameter have been identified as affected. Network access to the web application is required (AV:N). No non-default configuration or special feature enablement is identified as a prerequisite. The primary limiting factors are the authentication requirement and the narrow deployment footprint of this product. Any valid staff account (nurse, clerk, administrator) is sufficient - elevated or administrative privilege is not required.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) indicates network-accessible exploitation with low complexity and no attack requirements beyond a valid low-privilege account. The E:P suffix explicitly confirms the presence of a public proof-of-concept. Confidentiality, integrity, and availability impacts are each rated Low at the vulnerable-system level, with no subsequent-system scope change. The PR:L requirement is the primary limiting factor - anonymous internet attackers cannot exploit this without first obtaining credentials. However, in a hospital management context, a broad population of staff may hold valid accounts, widening the realistic attacker pool beyond what PR:L typically implies. EPSS data is not present in the provided input and cannot be assessed. KEV status is not confirmed, so no active exploitation campaign is established. Overall, this is a real but bounded risk: serious for any healthcare operator running this specific application, but tempered by the authentication prerequisite and the low prevalence of the product itself.

An attacker who holds or has obtained any valid low-privilege account within the hospital management system authenticates to the application and sends a crafted HTTP request to /viewappointmentapproved.php with a SQL payload injected into the delid parameter - for example, appending ' OR 1=1-- or a UNION-based extraction string. A public proof-of-concept is available on GitHub (https://github.com/ltranquility/vuln_submit/issues/23), enabling low-skill attackers to replicate the technique with minimal adaptation. Depending on the database account's permissions, the attacker could extract patient records, appointment details, credentials, or manipulate and delete stored data.