EUVD-2026-33508
GHSA-ch5g-97gx-qrr4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in code-projects Online Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /patient.php. Such manipulation of the argument editid leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
AnalysisAI
SQL injection in code-projects Online Hospital Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the editid parameter in /patient.php, potentially exposing or modifying patient records. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-authentication, network-accessible exploitation with no special conditions, and a public proof-of-concept has been disclosed via GitHub. While the CVSS 5.5 score reflects limited per-component impact (Low confidentiality, integrity, and availability), the absence of any access barrier combined with POC availability makes this an actionable risk for any exposed deployment.
Technical ContextAI
The affected application is a PHP-based web hospital management system (code-projects Online Hospital Management System 1.0) that processes patient record operations through /patient.php. The editid parameter, likely used to retrieve or edit patient records by ID, is passed unsanitized into SQL queries - a classic instance of CWE-74 (Injection), which encompasses failure to properly neutralize special elements that alter the intended SQL command structure. No CPE string was provided in the input data, but the application stack is confirmed as PHP with a relational database backend. The root cause is the absence of parameterized queries or prepared statements, meaning user-supplied input is concatenated directly into SQL, enabling manipulation of query logic. The referenced GitHub POC at https://github.com/aiyuyuyu/cve/blob/main/patient_sql.md documents the specific injection point.
RemediationAI
No vendor-released patch has been identified at time of analysis - patch status is unconfirmed from available data. Developers should immediately refactor /patient.php to use parameterized queries or prepared statements (e.g., PDO or MySQLi in PHP) for all database operations involving the editid parameter, which eliminates the SQL injection root cause entirely. As an immediate compensating control, deploying a web application firewall (WAF) with rules targeting SQL injection patterns in the editid parameter can reduce opportunistic exploitation; note that WAF rules can be bypassed by sophisticated attackers and should not substitute for a code-level fix. If editid is expected to be a numeric identifier, strict server-side allowlist validation (accepting only integer values and rejecting all other input) can be applied as a lightweight defense-in-depth measure with minimal operational side effects. Restricting network access to the application to only authorized internal networks or VPN would further limit the attack surface given the zero-auth exploitation profile. Monitor VulDB entry https://vuldb.com/vuln/367467 for updates on vendor patch availability.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Share
External POC / Exploit Code
Leaving vuln.today