code-projects Hospital Information System SQL Injection

SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate database queries through the `ID` parameter of the `getSinglePresp` function in `includes/presp/PrespController.php`. A public exploit has been released via GitHub, lowering the barrier for opportunistic attacks. Successful exploitation could expose sensitive patient records and medical data stored in the backend database, or allow unauthorized data modification.

SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search argument in the findBySearch() function of addReq.php. The CVSS 4.0 vector confirms network accessibility with no authentication, no complexity, and no user interaction required. Publicly available exploit code exists via a GitHub issue; no CISA KEV listing.

SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate backend database queries by supplying a crafted value in the ID argument to the viewReq() function within viewReq.php. The attack requires no authentication or user interaction, and a proof-of-concept exploit is publicly available via a GitHub issue. No vendor patch has been identified at time of analysis, leaving deployments with no official remediation path.