Hospital Management System EUVD-2026-60023

Exploitation requires a valid low-privilege authenticated session within the Hospital Management System - the CVSS 4.0 PR:L metric confirms that some form of application-level authentication is necessary; unauthenticated remote exploitation is not supported by the available data. The vulnerable endpoint is specifically /viewpatient.php and the injection point is the delid parameter, which must be attacker-controllable in the HTTP request. No special server-side configuration, non-default feature flag, or specific PHP version is cited as a prerequisite beyond the application being network-accessible. Limiting factors: the PR:L requirement restricts the realistic attacker pool to insiders, compromised credential holders, or users of self-registration features if the application allows them; the partial impact scope (VC:L/VI:L/VA:L) suggests the database account running application queries may operate with constrained permissions, capping the blast radius below full database takeover in well-hardened deployments.

The CVSS 4.0 score of 5.3 (Medium) reflects a constrained but real threat: the attack is network-reachable with low complexity and no special attack requirements, but PR:L authentication limits exposure compared to unauthenticated SQLi. The E:P modifier in the provided CVSS 4.0 vector explicitly confirms a public proof-of-concept exists, elevating practical exploitation likelihood well beyond what the base score suggests in isolation - even a mid-sized municipal IT team in inowroclaw operating this system for a local clinic should treat this as urgent given that partial patient record exposure (VC:L/VI:L) carries HIPAA or GDPR notification obligations regardless of CVSS tier. The vulnerability is absent from the CISA KEV catalog and no EPSS data was provided, so exploitation breadth remains unquantified; however, the combination of a public PoC, a niche application with likely infrequent patching cadence, and sensitive healthcare data makes the residual risk disproportionate to the medium CVSS label. No conflicting signals exist between the CVSS vector and the description - both consistently point to an authenticated, remote, low-complexity SQL injection.

An attacker with a valid low-privilege hospital staff account authenticates to the application and sends a crafted HTTP request to /viewpatient.php, injecting SQL syntax into the delid parameter - for example, appending a UNION SELECT payload to exfiltrate patient table contents or a Boolean-based blind injection to enumerate the database schema. The publicly available PoC on GitHub provides a ready-made template, enabling low-skill attackers to replicate the technique with minimal adaptation. Depending on the database account's permissions, the attacker could read sensitive patient records, alter data, or delete rows.