CVE-2026-15536

itsourcecode Hospital Management System patviewprescription.php sql injection

View on CVE.org
Published Jul 13, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patviewprescription.php. The manipulation of the argument delid leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Analysis

AI-generated

Technical impact

A flaw in itsourcecode Hospital Management System version 1.0 allows a remote attacker to inject arbitrary SQL code by manipulating the delid argument in the patviewprescription.php page. The injection can lead to execution of arbitrary SQL statements against the backend database, compromising data confidentiality, integrity, and availability. The vulnerability is a classic SQL injection identified by CWE‑74 and CWE‑89.

Affected Systems

The vulnerability affects Hospital Management System version 1.0 from itsourcecode, specifically the patviewprescription.php component that handles the delid parameter. No other products or versions are mentioned.

Risk and Exploitability

The flaw has a CVSS score of 5.3, indicating moderate severity. Its EPSS score is less a low exploitation probability, and it is not listed in the CISA KEV catalog. However, the exploit is publicly available and remote exploitation is possible, meaning that anyone who can reach the web application could potentially manipulate the database. Prompt remediation is therefore advisable.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑released patch for itsourcecode Hospital Management System once available.
  • Validate the delid input strictly, accepting only numeric values and rejecting all other characters before it is used in a query.
  • Rewrite database access or stored procedures to use parameterized queries.
  • Restrict access to patviewprescription.php to authenticated users and enforce least‑privilege database permissions.
  • Consider deploying a web application firewall to block SQL‑injection patterns against the application.

Generated by OpenCVE AI on August 1, 2026 at 10:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patviewprescription.php. The manipulation of the argument delid leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Title itsourcecode Hospital Management System patviewprescription.php sql injection
First Time appeared Itsourcecode
Itsourcecode hospital Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode hospital Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 15, 2026, 1:49 PM
Reserved
Jul 12, 2026, 5:59 PM

View source JSON

Updated
Jul 15, 2026, 1:49 PM

JSON

Status
Deferred
Published
Jul 13, 2026, 7:16 AM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Aug 1, 2026, 11:00 AM

JSON