EUVD-2026-54253
GHSA-3x84-4p75-993j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SQLi requires low-privilege authentication (PR:L); all impacts bounded to Low with no scope change, consistent with the provided CVSS 4.0 vector.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewappointment.php. This manipulation of the argument delid causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
AnalysisAI
SQL injection in itsourcecode Hospital Management System 1.0 exposes the appointment deletion endpoint /viewappointment.php to database manipulation by authenticated low-privileged users via the delid parameter. The vulnerability allows partial read, write, and availability impact against the underlying database. A proof-of-concept exploit has been publicly published (CVSS 4.0 E:P), lowering the bar for abuse. No public KEV listing or vendor patch has been identified at time of analysis.
Technical ContextAI
Hospital Management System 1.0 is a PHP-based web application distributed by itsourcecode, primarily used for educational and demonstration purposes. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), which is the parent class covering SQL injection. The root cause is unsanitized incorporation of the delid GET/POST parameter directly into a SQL query within /viewappointment.php, likely handling appointment deletion logic. The absence of parameterized queries or prepared statements allows an attacker to alter query structure. The application stack is PHP with a relational database backend (implied by SQL injection context). No CPE string was provided in the intelligence data; the affected product is identified solely as 'Hospital Management System 1.0' per EUVD-2026-54253.
RemediationAI
No vendor-released patch has been identified at time of analysis - no advisory from itsourcecode was found among the references, which point only to VulDB and GitHub issue trackers. The upstream fix, if any, has not been confirmed as a tagged release. As a compensating control, developers should immediately replace direct string concatenation in /viewappointment.php with parameterized queries or prepared statements for the delid parameter - this eliminates the injection point entirely. Restricting access to the appointment management interface to authenticated internal networks or VPNs reduces exposure. Deploying a web application firewall (WAF) rule targeting SQL metacharacter patterns in the delid parameter can provide short-term mitigation but should not substitute for code-level remediation. Input validation rejecting non-integer values for delid (since a deletion ID is expected to be numeric) is a minimal quick fix. References: https://github.com/ltranquility/submit_vuln/issues/16 (POC), https://vuldb.com/vuln/386540 (VulDB entry).
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today