Description
A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /patientchangepassword.php. Executing a manipulation of the argument newpassword can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-06-29
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the patientchangepassword.php component of itsourcecode Hospital Management System 1.0. Manipulating the newpassword argument triggers arbitrary SQL injection in the backend database, enabling attackers to read, modify, or delete data when changing a patient’s password. The weakness is a classic SQL injection flaw (CWE‑74) compounded by improper input validation (CWE‑89), which can compromise confidentiality and integrity of patient records and potentially allow full database takeover.

Affected Systems

Affected systems are the Hospital Management System product from itsourcecode, version 1.0, and all installations that expose the /patientchangepassword.php endpoint. The vulnerability applies to any environment running this specific application version; older or newer releases may not contain the flaw.

Risk and Exploitability

The CVSS score of 5.3 indicates a mid‑level severity, but the public availability of the exploit and the stated ability to launch it remotely increase the operational risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw by sending a crafted newpassword parameter over HTTP, potentially gaining unauthorized database access if the application does not perform proper sanitization.

Generated by OpenCVE AI on June 29, 2026 at 16:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Sanitize and validate the newpassword input to prevent SQL injection.
  • Use prepared statements or parameterized queries instead of constructing SQL directly.
  • Enforce input length and character restrictions, such as allowing only alphanumeric characters for new passwords.

Generated by OpenCVE AI on June 29, 2026 at 16:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 29 Jun 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 29 Jun 2026 15:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /patientchangepassword.php. Executing a manipulation of the argument newpassword can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Title itsourcecode Hospital Management System patientchangepassword.php sql injection
First Time appeared Itsourcecode
Itsourcecode hospital Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode hospital Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Hospital Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-29T15:52:01.092Z

Reserved: 2026-06-28T22:26:05.234Z

Link: CVE-2026-13579

cve-icon Vulnrichment

Updated: 2026-06-29T15:51:57.764Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-29T16:30:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')