Description
A vulnerability was identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patviewprescription.php. The manipulation of the argument delid leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Published: 2026-07-13
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in itsourcecode Hospital Management System version 1.0 allows a remote attacker to inject arbitrary SQL code by manipulating the delid argument in the patviewprescription.php page. The injection can lead to execution of arbitrary SQL statements against the backend database, compromising data confidentiality, integrity, and availability. The vulnerability is a classic SQL injection identified by CWE‑74 and CWE‑89.

Affected Systems

The vulnerability affects Hospital Management System version 1.0 from itsourcecode, specifically the patviewprescription.php component that handles the delid parameter. No other products or versions are mentioned.

Risk and Exploitability

The flaw has a CVSS score of 5.3, indicating moderate severity. Its EPSS score is less a low exploitation probability, and it is not listed in the CISA KEV catalog. However, the exploit is publicly available and remote exploitation is possible, meaning that anyone who can reach the web application could potentially manipulate the database. Prompt remediation is therefore advisable.

Generated by OpenCVE AI on August 1, 2026 at 10:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑released patch for itsourcecode Hospital Management System once available.
  • Validate the delid input strictly, accepting only numeric values and rejecting all other characters before it is used in a query.
  • Rewrite database access or stored procedures to use parameterized queries.
  • Restrict access to patviewprescription.php to authenticated users and enforce least‑privilege database permissions.
  • Consider deploying a web application firewall to block SQL‑injection patterns against the application.

Generated by OpenCVE AI on August 1, 2026 at 10:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 06:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patviewprescription.php. The manipulation of the argument delid leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Title itsourcecode Hospital Management System patviewprescription.php sql injection
First Time appeared Itsourcecode
Itsourcecode hospital Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode hospital Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Hospital Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-15T13:49:32.177Z

Reserved: 2026-07-12T17:59:23.159Z

Link: CVE-2026-15536

cve-icon Vulnrichment

Updated: 2026-07-15T13:49:20.669Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T11:00:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')