EUVD-2026-70859
GHSA-5w5p-m5fw-5c8v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP GET/POST to addReq.php
-
ExploitInject SQL payload into Search parameter
-
ExecutionBypass query logic via unsanitized concatenation
-
ImpactExtract or modify hospital database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated remote exploitation against any network-accessible instance of Hospital Information System 1.0 in its default configuration. The only limiting factor is deployment scope: the product is an educational/demo application from code-projects.org and is unlikely to be widely deployed in production. Any instance exposed to the internet or an untrusted network is exploitable without credentials or user interaction. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) rates impact conservatively as Low across confidentiality, integrity, and availability, yielding a score of 5.5 (Medium). The E:P supplemental metric confirms exploit code is publicly available, which lowers the barrier for exploitation significantly. No CISA KEV listing exists, and EPSS data was not supplied, but POC availability raises real-world risk above what the base score alone implies. The primary limiting factor is the product's deployment footprint - code-projects.org publishes educational/demo software not intended for production use, so the attack surface in live environments should be small. However, any instance reachable from the network is trivially exploitable with no authentication required. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to the publicly accessible addReq.php endpoint, injecting SQL syntax into the Search parameter (e.g., a UNION-based or error-based payload). The unsanitized input is passed directly into the SQL query by findBySearch(), allowing the attacker to extract patient records, credentials, or other sensitive hospital data from the database. Publicly available exploit code on GitHub lowers the skill threshold for this attack to near-zero. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search argument in the findBySearch() function of addReq.php. The CVSS 4.0 vector confirms network accessibility with no authentication, no complexity, and no user interaction required. Publicly available exploit code exists via a GitHub issue; no CISA KEV listing.
RemediationAI
No vendor-released patch has been identified at time of analysis. Code-projects.org hosts educational and demonstration software that typically does not receive security patches. The primary recommendation is to avoid deploying this software in any production or internet-accessible environment. If the application must remain operational, the specific fix is to rewrite the findBySearch() function in addReq.php to use parameterized queries or prepared statements (PDO or MySQLi with bound parameters) rather than string concatenation. As a compensating control, deploying a web application firewall (WAF) with SQL injection detection rules in front of the addReq.php endpoint can reduce exploitation risk, though it is not a substitute for fixing the underlying code. Restricting access to the application to trusted IP ranges via server-level ACLs is a further risk-reduction measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is code-projects Hospital Information System 1.0 (CPE: cpe:2.3:a:code-projects:hospital_information_system:*:*:*:*:*:*:*:*), a PHP-based web application hosted on the code-projects.org educational/demo platform. CWE-89 (SQL Injection) identifies the root cause: the findBySearch() function in addReq.php directly concatenates the user-supplied Search parameter into a SQL query without parameterization or sanitization. This classic unsanitized input pattern allows an attacker to alter query logic, extract data, modify records, or potentially escalate to OS-level access depending on database privileges.
Know when Hospital Information System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-accessible unauthenticated endpoint, no complexity; limited C/I/A impact consistent with CWE-89 in a single-application context.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.php. This manipulation of the argument Search causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in code-projects Hospital Information System SQL Injection
View all 3More in Hospital Information System
View allHospital Information System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication
Hospital Information System 1.0 by code-projects exposes its raw SQL database backup file at the web-accessible path `/H
Code Projects Hospital Information System 1.0 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 4
Reflected cross-site scripting (XSS) in code-projects Hospital Information System 1.0 allows a remote authenticated atta
Exploit-DB