Description
A flaw has been found in code-projects Online Hospital Management System 1.php. This impacts the function login_user of the file login_1.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
Published: 2026-06-01
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is a SQL injection flaw in the login_user function of login_1.php in code‑projects Online Hospital Management System. A malicious user can send a specially crafted Username parameter that is embedded directly into a SQL query, allowing arbitrary SQL statements to be executed. This can result in complete theft, alteration, or deletion of patient records and other sensitive data. The flaw is classified as CWE‑74 and CWE‑89.

Affected Systems

The affected product is code‑projects Online Hospital Management System, specifically the login_1.php module. No specific version numbers are supplied, so the vulnerability may exist in all publicly available releases until a patch is applied.

Risk and Exploitability

The CVSS score of 6.9 indicates a high potential for damage, and the vulnerability is exploitable remotely through the web interface. While EPSS data is unavailable and it is not listed in the KEV catalog, the fact that the exploit is already published and can be leveraged without special privileges means the risk is significant. An attacker who succeeds could gain unauthorised database access, compromising confidentiality and integrity of patient data.

Generated by OpenCVE AI on June 1, 2026 at 02:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch or upgrade to a release that includes the fix for the login_user function.
  • If no patch exists, modify the login_user code to use prepared statements or parameterised queries for all user input.
  • Add input validation on the Username field, restricting input to a defined whitelist of characters and lengths.
  • Restrict access to the login page to trusted IP ranges or enable multi‑factor authentication to reduce the likelihood of remote exploitation.

Generated by OpenCVE AI on June 1, 2026 at 02:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 02 Jun 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 01 Jun 2026 01:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in code-projects Online Hospital Management System 1.php. This impacts the function login_user of the file login_1.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
Title code-projects Online Hospital Management System login_1.php login_user sql injection
First Time appeared Code-projects
Code-projects online Hospital Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:online_hospital_management_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects online Hospital Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Hospital Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-02T14:57:45.868Z

Reserved: 2026-05-31T07:01:28.058Z

Link: CVE-2026-10208

cve-icon Vulnrichment

Updated: 2026-06-02T14:57:40.819Z

cve-icon NVD

Status : Deferred

Published: 2026-06-01T02:16:16.477

Modified: 2026-06-01T15:15:37.293

Link: CVE-2026-10208

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-01T04:30:19Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')