Hospital Management System EUVD-2026-64647

Exploitation requires that the attacker hold at least a low-privilege authenticated session within the Hospital Management System application, as indicated by PR:L in the CVSS 4.0 vector - fully anonymous exploitation is not supported. The vulnerable endpoint is /viewservicetype.php and the injection point is specifically the delid parameter; no other configuration change or special feature enablement is documented as required. No user interaction from a second party is necessary once an authenticated session is established. Limiting factors include the requirement for a valid application account (ruling out unauthenticated internet-scale exploitation) and the product's narrow deployment footprint as a free educational PHP project. There is no indication from available data that the delid parameter is restricted to administrative roles, meaning any authenticated user may be able to trigger the flaw.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) places this as network-accessible, low-complexity exploitation requiring only a low-privilege authenticated session with no user interaction. The E:P modifier in the CVSS 4.0 vector confirms publicly available exploit code, meaningfully elevating practical exploitability beyond what the 5.3 base score alone suggests. No EPSS data was supplied and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis. Because the product is a free educational PHP project rather than enterprise software, real-world deployment footprint is narrow - limiting aggregate exposure even though the technical bar for exploitation is low. The public exploit lowers the skill threshold to script-level attackers, so any authenticated user of an exposed instance should be treated as a realistic threat actor.

An attacker with a low-privilege account on the Hospital Management System sends a crafted HTTP request to /viewservicetype.php with a SQL payload injected into the delid parameter - for example, a UNION-based query to extract table contents or an OR-condition to bypass delete-confirmation logic. With publicly available exploit code at https://github.com/ltranquility/vuln_submit/issues/25, a script-level attacker can enumerate or exfiltrate the underlying database, including patient records and service configuration data, without requiring elevated application privileges.