Hospital Management System EUVD-2026-35055

Exploitation requires a valid authenticated session with at minimum low-privilege access to the Hospital Management System application, as confirmed by the CVSS 4.0 vector PR:L. The specific injection point is the 'Date' parameter handled by /adminaccount.php, meaning the attacker must be able to reach and submit requests to that administrative endpoint. The application must be running itsourcecode Hospital Management System 1.0 (or a version sharing the same vulnerable code) and must be reachable over a network (AV:N). Exploitation is NOT limited by attack complexity (AC:L) or attack requirements (AT:N), meaning no race conditions or special target state is needed beyond authenticated access. Exploitation is limited to attackers who can authenticate - unauthenticated remote exploitation is NOT supported by the CVSS vector. Impact is further constrained to the scope of the application's own database permissions, with no confirmed path to broader system compromise.

The CVSS 4.0 base score of 2.1 is intentionally low and should be interpreted carefully. The vector AV:N/AC:L/AT:N/PR:L/UI:N indicates network-reachable, low-complexity exploitation requiring no user interaction - which sounds severe - but PR:L (low privileges required) means the attacker must already hold some authenticated session. Impact is bounded: VC:L/VI:L/VA:L with no subsequent scope impact (SC:N/SI:N/SA:N), suggesting the SQL injection permits limited data read/write within the application's database context rather than full database takeover or OS-level compromise. The exploit maturity modifier E:P confirms a proof-of-concept is publicly available, raising the practical exploitation likelihood above what the base score alone suggests. There is no CISA KEV listing and no EPSS score provided, so widespread automated exploitation is not confirmed. The primary real-world risk is to healthcare organizations running this specific open-source script, where patient records or appointment data could be partially exfiltrated or tampered with by an authenticated user escalating their access.

A publicly available proof-of-concept exists, linked via GitHub (https://github.com/ltranquility/vuln_submit/issues/14) and catalogued by VulDB. An authenticated attacker with low-level access to the Hospital Management System - such as a receptionist or data-entry account - navigates to /adminaccount.php and injects SQL payloads into the 'Date' parameter of a form submission or URL query string. The injected query executes against the backend database, potentially extracting patient records, appointment data, or credential hashes visible to the application's database user.