Hospital Management System EUVD-2026-60561

Exploitation requires a valid low-privilege user account within the Hospital Management System, consistent with the CVSS 4.0 PR:L designation - unauthenticated access to the vulnerable endpoint is not sufficient. The specific vulnerable endpoint is /viewdepartment.php and the injection point is the delid GET or POST parameter; no non-default configuration is required beyond the application being network-accessible. Exploitation is limited by the authentication prerequisite (any valid login) and the product's narrow deployment footprint. There is no indication of a required specific role or elevated permission beyond basic login access. Remote network reachability (AV:N) is required - local-only deployments not exposed over a network reduce exposure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) establishes this as a network-reachable, low-complexity attack requiring only low-privilege authentication with no user interaction needed. Impact is bounded to the vulnerable system with no subsequent-system scope change. No EPSS data was provided in the intelligence, and the vulnerability is absent from CISA KEV, indicating no confirmed widespread or targeted exploitation. However, the E:P exploit-maturity modifier confirms a public proof-of-concept exists on GitHub, compressing the time-to-exploit for opportunistic actors. The moderate CVSS score partially understates real-world sensitivity: this application handles patient and departmental data, so even low-confidence data extraction carries meaningful consequences in healthcare contexts. Risk is primarily constrained by the product's narrow deployment footprint.

An attacker with a low-privilege account in the Hospital Management System sends a crafted HTTP request to /viewdepartment.php?delid=1 UNION SELECT username,password,3 FROM users--, exploiting the unsanitized parameter to extract credential data from the database. A public proof-of-concept demonstrating this technique is available at https://github.com/11snk/CVE/issues/4, allowing low-skilled actors to reproduce the attack with minimal adaptation. If the database user has write permissions, the attacker could additionally modify or delete department records.