EUVD-2026-30729
GHSA-jhq7-r7p6-3g3j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend GET request with SQL payload
-
ExploitInject into getAllPatientDetail query
-
ImpactExtract patient database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Hospital Management System in PHP. The vulnerable update_info.php endpoint must be accessible via web, which is standard for this application. No authentication, special configuration, or user interaction required. Exploitation limited only by network access to the web application. |
| Impact | The CVSS 3.1 score of 7.3 reflects network-accessible, no-authentication-required exploitation with low attack complexity. The exploit code maturity is marked as Proof-of-Concept (E:P), and remediation level is unavailable (RL:X), indicating no vendor fix exists. While not listed in CISA KEV, the combination of public exploit availability, healthcare sector target, and patient data exposure creates significant risk. The moderate CVSS score (not critical) is due to limited impact ratings (C:L/I:L/A:L) rather than difficulty of exploitation. Healthcare organizations using this software face immediate risk of patient data breach and regulatory compliance violations. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP GET request to update_info.php with SQL injection payload in the appointment_no parameter. The getAllPatientDetail function executes the malicious SQL, allowing the attacker to extract patient records, modify medical data, or potentially gain broader database access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 18, 2026
SQL injection in projectworlds Hospital Management System in PHP 1.0 enables unauthenticated remote attackers to extract or modify patient data through the appointment_no parameter in update_info.php. The vulnerability has publicly available exploit code and affects the getAllPatientDetail function, with the vendor notified but unresponsive.
RemediationAI
No vendor-released patch identified at time of analysis. The vendor was notified via GitHub issue but remains unresponsive. Immediate mitigation requires either replacing the vulnerable software or implementing web application firewall (WAF) rules to block SQL injection patterns in the appointment_no parameter. If continued use is necessary, implement input validation for the appointment_no field to accept only numeric values, parameterize all SQL queries in update_info.php, and restrict database user permissions to minimum required operations. Monitor logs for exploitation attempts targeting update_info.php with suspicious appointment_no values.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects projectworlds Hospital Management System in PHP version 1.0, a web-based healthcare application. The flaw is a classic SQL injection (CWE-89) where user input from the appointment_no GET parameter is directly incorporated into SQL queries without proper sanitization in the getAllPatientDetail function within update_info.php. This allows attackers to inject arbitrary SQL commands that execute in the context of the database connection.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the component GET Parameter Handler. Executing a manipulation of the argument appointment_no can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Executive ViewAI
CVE-2026-8785 is a SQL injection vulnerability in projectworlds Hospital Management System PHP 1.0 that allows unauthenticated attackers to directly access and modify patient records, creating immediate risk to protected health information (PHI) and regulatory compliance. Organizations deploying this system face potential data breach, HIPAA violations, and operational disruption without an available vendor patch.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network segmentation restricting access to update_info.php to authenticated internal users only via VPN/bastion host; (2) Deploy WAF with SQL injection detection rules targeting the appointment_no parameter; (3) Enable comprehensive database activity monitoring and alerting on unauthorized SELECT/UPDATE/DELETE operations; (4) Enforce database user least-privilege principles; (5) Conduct immediate backup verification and restore testing for patient data recovery capability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB