Description
A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=save_patient. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-06-08
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is a classic SQL injection vulnerability in the save_patient function of the Master.php file. By manipulating the ID parameter, an attacker can inject arbitrary SQL code. This weakness is explicitly listed as CWE-89 and CWE-74 in the CVE record. Attackers can execute the injection remotely, without local access, thereby exposing the underlying database to commands that can read, modify or delete patient records.

Affected Systems

Only the 1.0 release of SourceCodester’s Hospitals Patient Records Management System is known to be affected. The vulnerability resides in the /classes/Master.php file, specifically when a request is made with ?f=save_patient. No other versions or components are listed as impacted.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity, and no EPSS score is provided. The vulnerability is not listed in CISA’s KEV catalog, but public exploit code has already been published. Because the flaw can be triggered over the network, an unauthenticated remote attacker could compromise the database and gain access to sensitive health records.

Generated by OpenCVE AI on June 8, 2026 at 11:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s security patch or firmware update for Hospitals Patient Records Management System 1.0 as soon as it is made available.
  • Sanitize the ID argument on the server side and use prepared statements with bound parameters to eliminate the injection vector.
  • Configure a web‑application firewall or restrict access to the /classes/Master.php?f=save_patient endpoint to trusted IP ranges or authenticated users.

Generated by OpenCVE AI on June 8, 2026 at 11:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 08 Jun 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 08 Jun 2026 10:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=save_patient. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Title SourceCodester Hospitals Patient Records Management System Master.php save_patient sql injection
First Time appeared Sourcecodester
Sourcecodester hospitals Patient Records Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:hospitals_patient_records_management_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester hospitals Patient Records Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Hospitals Patient Records Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-08T10:15:26.080Z

Reserved: 2026-06-07T13:41:10.024Z

Link: CVE-2026-11501

cve-icon Vulnrichment

Updated: 2026-06-08T10:15:21.650Z

cve-icon NVD

Status : Received

Published: 2026-06-08T10:16:32.613

Modified: 2026-06-08T10:16:32.613

Link: CVE-2026-11501

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-08T11:30:22Z

Weaknesses