Hospital Management System EUVD-2026-60066

Exploitation requires a valid authenticated session with at minimum low-privilege access (PR:L per CVSS 4.0 vector) to the Hospital Management System 1.0 web application - unauthenticated remote exploitation is not possible. The /viewprescriptionrecord.php endpoint must be network-accessible (AV:N), which is typical for web-hosted deployments. No non-default configuration or special feature enablement is required beyond a functioning installation. Exploitation is bounded by the authentication barrier; attackers must first obtain valid credentials through credential theft, phishing, or brute-force prior to leveraging this SQL injection. No user interaction from a victim is required once credentials are obtained.

The CVSS 4.0 score of 2.1 reflects restrained impact ratings (VC:L/VI:L/VA:L) and a low-privilege authentication requirement (PR:L), placing this in the Low severity band despite network-level access. The E:P modifier raises real-world concern because the attack path is now documented and reproducible via publicly released exploit code. No CISA KEV listing is present, confirming active widespread exploitation is not currently observed. EPSS data was not provided in the available intelligence and could not be assessed. Even a mid-sized municipal IT team in opole operating this system for a local clinic should treat remediation as a priority given the combination of healthcare data sensitivity, confirmed public exploit code, and the relative ease of obtaining low-privilege credentials through phishing or credential stuffing. The low CVSS score does not fully capture the regulatory exposure risk from patient data disclosure under healthcare privacy frameworks.

An attacker with a low-privilege authenticated account logs into the Hospital Management System and sends a crafted HTTP request to /viewprescriptionrecord.php with a SQL injection payload in the delid parameter, such as a UNION-based query to extract usernames, password hashes, or patient prescription records. Using the publicly available exploit code referenced at https://github.com/Kristin5634487/cve/issues/3, the attacker requires no specialized tooling beyond a browser or basic HTTP client to enumerate and dump database contents.