Hospital Information System
Monthly
Hospital Information System 1.0 by code-projects exposes its raw SQL database backup file at the web-accessible path `/HIS/his.sql`, allowing unauthenticated remote attackers to download the full database dump over HTTP with no prerequisites. The vulnerability (CWE-200) stems from placing the database export file inside the application's web root without access controls. A public proof-of-concept exploit document is available on GitHub, confirming practical exploitability; no KEV listing has been issued at time of analysis.
Reflected cross-site scripting (XSS) in code-projects Hospital Information System 1.0 allows a remote authenticated attacker to inject arbitrary JavaScript into victim browsers via the unsanitized `id` parameter in `/HIS/src/patients/editPatient.php`. An attacker who can craft a malicious URL and induce an authenticated user to click it can execute scripts in the victim's browser session, enabling session hijacking, credential theft, or UI redress. A public proof-of-concept exploit is available on GitHub; no KEV listing exists, and the CVSS 4.0 score of 2.0 reflects the limited real-world impact given authentication and user-interaction prerequisites.
SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate database queries through the `ID` parameter of the `getSinglePresp` function in `includes/presp/PrespController.php`. A public exploit has been released via GitHub, lowering the barrier for opportunistic attacks. Successful exploitation could expose sensitive patient records and medical data stored in the backend database, or allow unauthorized data modification.
SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate backend database queries by supplying a crafted value in the ID argument to the viewReq() function within viewReq.php. The attack requires no authentication or user interaction, and a proof-of-concept exploit is publicly available via a GitHub issue. No vendor patch has been identified at time of analysis, leaving deployments with no official remediation path.
SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search argument in the findBySearch() function of addReq.php. The CVSS 4.0 vector confirms network accessibility with no authentication, no complexity, and no user interaction required. Publicly available exploit code exists via a GitHub issue; no CISA KEV listing.
Code Projects Hospital Information System 1.0 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Hospital Information System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Hospital Information System 1.0 by code-projects exposes its raw SQL database backup file at the web-accessible path `/HIS/his.sql`, allowing unauthenticated remote attackers to download the full database dump over HTTP with no prerequisites. The vulnerability (CWE-200) stems from placing the database export file inside the application's web root without access controls. A public proof-of-concept exploit document is available on GitHub, confirming practical exploitability; no KEV listing has been issued at time of analysis.
Reflected cross-site scripting (XSS) in code-projects Hospital Information System 1.0 allows a remote authenticated attacker to inject arbitrary JavaScript into victim browsers via the unsanitized `id` parameter in `/HIS/src/patients/editPatient.php`. An attacker who can craft a malicious URL and induce an authenticated user to click it can execute scripts in the victim's browser session, enabling session hijacking, credential theft, or UI redress. A public proof-of-concept exploit is available on GitHub; no KEV listing exists, and the CVSS 4.0 score of 2.0 reflects the limited real-world impact given authentication and user-interaction prerequisites.
SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate database queries through the `ID` parameter of the `getSinglePresp` function in `includes/presp/PrespController.php`. A public exploit has been released via GitHub, lowering the barrier for opportunistic attacks. Successful exploitation could expose sensitive patient records and medical data stored in the backend database, or allow unauthorized data modification.
SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate backend database queries by supplying a crafted value in the ID argument to the viewReq() function within viewReq.php. The attack requires no authentication or user interaction, and a proof-of-concept exploit is publicly available via a GitHub issue. No vendor patch has been identified at time of analysis, leaving deployments with no official remediation path.
SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search argument in the findBySearch() function of addReq.php. The CVSS 4.0 vector confirms network accessibility with no authentication, no complexity, and no user interaction required. Publicly available exploit code exists via a GitHub issue; no CISA KEV listing.
Code Projects Hospital Information System 1.0 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Hospital Information System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.