Hospital Management System EUVD-2026-47594

Exploitation requires a valid low-privilege user session on the Hospital Management System 1.0 application (PR:L per the CVSS 4.0 vector) - unauthenticated exploitation is not supported by the available data. The vulnerable parameter editid must be processed by /prescription.php, which appears to be a standard feature of the application requiring no non-default configuration. No specific operating system, PHP version, or database configuration has been identified as a prerequisite beyond a running instance of version 1.0. Limiting factors include the authentication barrier (a valid account is required), the low reported impact ceiling (VC:L/VI:L/VA:L suggesting constrained database access), and the product's niche, educational-codebase deployment profile. Remote unauthenticated exploitation is not confirmed and should not be assumed.

The CVSS 4.0 score of 2.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) reflects network-reachable exploitation requiring low-privilege authentication, with uniformly low impact across confidentiality, integrity, and availability. This low impact rating is atypical for SQL injection, which commonly yields full database read/write access; it likely reflects either a tightly restricted database user account or the reporter's conservative assessment. No EPSS data was supplied, and the vulnerability is not listed in CISA KEV, meaning active exploitation in production environments is not confirmed. However, the E:P (exploit public) modifier in the provided CVSS 4.0 vector confirms a PoC exists on GitHub, which is a concrete escalation risk signal. The primary real-world risk is constrained by the product's obscurity - itsourcecode Hospital Management System is an educational/demo codebase with negligible confirmed enterprise deployment. Analysts should not treat the low CVSS score as evidence of low SQL injection severity in general; the impact metrics here likely reflect context-specific constraints rather than the vulnerability class's typical ceiling.

An attacker with a low-privilege account on an exposed Hospital Management System 1.0 instance submits a crafted HTTP request to /prescription.php with a SQL payload in the editid parameter - for example, appending a UNION-based or boolean-blind injection string. A public PoC is available at https://github.com/shohatmedhat535-dotcom/cve-records/issues/1, enabling low-skill exploitation. Depending on the database user's permissions, the attacker may be able to extract prescription records, patient data, or credentials stored in the database.