Description
A vulnerability has been found in code-projects Online Hospital Management System 1.0. Affected is an unknown function of the file appointmentdetail.php of the component Appointment Handler. The manipulation of the argument editid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-06-01
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability affects the appointmentdetail.php function of the Online Hospital Management System, allowing attackers to manipulate the editid argument and inject arbitrary SQL statements. This flaw is a classic SQL injection, classified under CWE-74 and CWE-89, and can lead to unauthorized read, modify or delete operations on the database, compromising both confidentiality and integrity.

Affected Systems

The affected product is code-projects' Online Hospital Management System, version 1.0. No additional versions have been reported as vulnerable at this time.

Risk and Exploitability

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw remotely by supplying a crafted editid value in a request to appointmentdetail.php, which is then concatenated into an SQL query without proper sanitization. Because the flaw is file‑specific and not tied to authentication, any external user who can reach the URL could potentially exploit the injection if no additional access controls are in place.

Generated by OpenCVE AI on June 1, 2026 at 02:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest version of the Online Hospital Management System that patches the SQL injection in appointmentdetail.php.
  • Apply input validation to the editid parameter, ensuring it accepts only numeric values and using prepared statements to construct database queries.
  • Deploy a Web Application Firewall rule to detect and block SQL injection patterns targeting the editid parameter in appointmentdetail.php.
  • Restrict access to appointmentdetail.php to authenticated users with appropriate permissions to limit the exposure of the vulnerable functionality.

Generated by OpenCVE AI on June 1, 2026 at 02:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 03 Jun 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 01 Jun 2026 01:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in code-projects Online Hospital Management System 1.0. Affected is an unknown function of the file appointmentdetail.php of the component Appointment Handler. The manipulation of the argument editid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
Title code-projects Online Hospital Management System Appointment appointmentdetail.php sql injection
First Time appeared Code-projects
Code-projects online Hospital Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:online_hospital_management_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects online Hospital Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Hospital Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-03T18:12:18.809Z

Reserved: 2026-05-31T07:01:30.381Z

Link: CVE-2026-10209

cve-icon Vulnrichment

Updated: 2026-06-03T18:12:04.040Z

cve-icon NVD

Status : Deferred

Published: 2026-06-01T02:16:17.370

Modified: 2026-06-01T15:15:37.293

Link: CVE-2026-10209

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-01T03:00:08Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')