EUVD-2026-41739
GHSA-p2j7-6426-r5wg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SQL injection requiring authenticated low-privileged access (PR:L); uniform low CIA impact with no scope change to other systems.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patientreport.php. Executing a manipulation of the argument editid can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
AnalysisAI
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /patientreport.php endpoint to remote manipulation via the editid parameter, allowing an authenticated attacker to craft arbitrary SQL statements against the backend database. The CVSS 4.0 base score is 2.1 (Low), reflecting constrained confidentiality, integrity, and availability impact, with no scope change to adjacent systems. Publicly available exploit code exists (E:P per the CVSS 4.0 threat metric), though no active exploitation has been confirmed via CISA KEV.
Technical ContextAI
The affected product is a PHP-based Hospital Management System (version 1.0) distributed by itsourcecode, primarily used as an educational or demonstration codebase rather than hardened production software. The vulnerability resides in /patientreport.php, where the editid request parameter is incorporated into a SQL query without proper sanitization or parameterization. The root cause class is CWE-74 (Injection), which encompasses failures to neutralize user-controlled input before it is interpreted by a downstream interpreter - in this case, a SQL database engine. No CPE strings were provided, but the affected artifact is unambiguously identified as itsourcecode Hospital Management System 1.0. The attack surface is the web application layer over HTTP/HTTPS, consistent with the AV:N (network) attack vector in the CVSS 4.0 vector.
RemediationAI
No vendor-released patch has been identified at the time of analysis. Given that itsourcecode software is primarily an educational codebase, an official upstream fix may not be forthcoming; operators should treat remediation as an internal responsibility. The primary fix is to replace direct SQL string concatenation in /patientreport.php with parameterized queries or prepared statements (e.g., PHP PDO or MySQLi with bound parameters), which eliminates the injection surface entirely. As an immediate compensating control, server-side input validation should enforce that editid accepts only integer values, rejecting all non-numeric input before it reaches the query layer - this reduces but does not eliminate risk if bypass techniques are applied. Deploying a Web Application Firewall rule targeting SQL metacharacters in the editid parameter can block known PoC payloads but introduces maintenance overhead and is bypassable by obfuscation. Database accounts used by the application should be restricted to the minimum required privileges (SELECT only where applicable) to limit the impact of a successful injection. Organizations running this software in a healthcare context should evaluate migration to a maintained, audited system, given the sensitivity of patient data at risk.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today