An SQL injection flaw was discovered in the Hospital Management System’s addpatient.php. The flaw lies in an undocumented function that processes the admissiontme argument, allowing attackers to inject malicious SQL. This issue reflects common SQL injection weaknesses (CWE-74, CWE-89). Because the injection can be triggered remotely and exploits have already been published, an attacker could run arbitrary SQL statements, potentially compromising or destroying patient data.

The vulnerability affects itsourcecode’s Hospital Management System version 1.0. No other product versions or vendors are listed as impacted, but any deployment of version 1.0 accessed through the web interface is susceptible.

With a CVSS score of 5.3, the flaw carries moderate severity. The EPSS is not available, and the vulnerability is not yet listed in CISA’s KEV catalog. The attack vector is remote via the web application; an attacker can exploit the flaw by sending a crafted admissiontme value to the addpatient.php endpoint, triggering the injection before authentication or authorization checks. Published exploits indicate that automated tools can easily take advantage of this weakness.