EUVD-2026-42223
GHSA-g684-5gx4-77w9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated SQL injection with no user interaction (AV:N/AC:L/PR:N/UI:N); full database read/write gives C:H/I:H/A:H within an unchanged scope.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Webbeyaz Web Design Mediküm Web allows SQL Injection.
This issue affects Mediküm Web: through 08072026. NOTE: The vendor was contacted and it was learned that the product is not supported.
AnalysisAI
SQL injection in Webbeyaz Web Design's Mediküm Web application (all versions through build 08072026) lets remote unauthenticated attackers inject arbitrary SQL commands, yielding full read/write control over the backend database. The CVSS 9.8 rating reflects network-reachable exploitation with no authentication or user interaction; no public exploit has been identified at time of analysis. Critically, the vendor confirmed to TR-CERT that the product is end-of-life and unsupported, so no fix will be issued.
Technical ContextAI
The flaw is a classic CWE-89 (improper neutralization of special elements in an SQL command) affecting Mediküm Web, a Turkish web application (the 'Medikum' branding and TR-CERT reporting point to a healthcare/clinic-oriented web product from vendor Webbeyaz Web Design). Per the CPE cpe:2.3:a:webbeyaz_web_design:mediküm_web:*:*:*:*:*:*:*:*, all versions are in scope. The root cause is user-controllable input concatenated directly into SQL query strings without parameterization or proper escaping, allowing an attacker to alter query semantics. Because the CVSS scope is Unchanged (S:U) and impacts C/I/A are all High, the injection appears to run against a database whose contents constitute the full attack surface, typical of a monolithic web app talking to a single application database.
RemediationAI
No vendor-released patch identified at time of analysis, and none is expected - the vendor confirmed to TR-CERT that Mediküm Web is end-of-life and unsupported - so the primary recommendation is to decommission or migrate off the product to a maintained alternative. Until migration, place the application behind a web application firewall tuned to block SQL injection patterns (accepting that WAF rules can be bypassed and may cause false positives on legitimate clinical data entry), restrict network exposure by removing the app from the public internet and limiting access to a VPN or allow-listed source IPs (trade-off: breaks remote/public patient-facing access), enforce least-privilege on the database account the app uses so a successful injection cannot escalate beyond the app's own schema, and enable database query logging plus monitoring for anomalous or high-volume queries. Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0518 for any vendor-specific guidance.
More in Medik M Web
View allReflected XSS in Mediküm Web, a Turkish healthcare web application by Webbeyaz Web Design, enables unauthenticated remot
Stored cross-site scripting in Mediküm Web (by Webbeyaz Web Design) enables authenticated low-privilege attackers to per
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today