Description
A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /payment.php. The manipulation of the argument patientid results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
Published: 2026-07-05
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerable parameter, patientid, in the payment.php script of itsourcecode Hospital Management System 1.0 can be manipulated to inject arbitrary SQL. The flaw permits an attacker to potentially retrieve, modify, or delete data. This weakness is associated with CWE‑89 (SQL Injection) and undermines the confidentiality and integrity of data stored in the system.

Affected Systems

The vulnerability impacts version 1.0 of Hospital Management System from itsourcecode. It is present in the payment.php component and any installations running this version are susceptible. No later versions are listed as affected, and no details of patch availability are provided in the supplied data.

Risk and Exploitability

The CVSS v3 score of 5.3 indicates moderate severity. The EPSS score of less than 1 % shows a very low probability of exploitation, yet a public exploit can be triggered remotely over the network. The vulnerability is not recorded in the CISA KEV catalog, implying no widespread attack campaigns currently documented.

Generated by OpenCVE AI on July 23, 2026 at 15:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a patched version of Hospital Management System that addresses the SQL injection in payment.php (if available).
  • Validate and sanitize the patientid input and employ parameterised queries to eliminate injection opportunities.
  • Restrict access to payment.php by requiring authentication and enforcing network segmentation so only authorized users can reach the endpoint.
  • Deploy a web application firewall configured to detect and block common SQL injection patterns on incoming traffic.

Generated by OpenCVE AI on July 23, 2026 at 15:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /payment.php. The manipulation of the argument patientid results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
Title itsourcecode Hospital Management System payment.php sql injection
First Time appeared Itsourcecode
Itsourcecode hospital Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode hospital Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Hospital Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T15:16:07.186Z

Reserved: 2026-07-05T04:03:50.118Z

Link: CVE-2026-14773

cve-icon Vulnrichment

Updated: 2026-07-06T15:16:00.960Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-23T15:45:02Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')