Description
A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicetype.php. This manipulation of the argument editid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-08-06
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the editid parameter of the /servicetype.php file in itsourcecode Hospital Management System 1.0, allowing attackers to inject arbitrary SQL statements. This flaw permits remote exploitation that could lead to unauthorized read, modification, or deletion of database records, directly compromising patient confidentiality and system integrity. The weakness is a classic SQL injection, classified as CWE‑89 and involves improper input neutralization (CWE‑74).

Affected Systems

Itsourcecode Hospital Management System 1.0 is affected. The flaw is located in the servicetype.php component and is present in the default installation of the product. No other versions are reported in the CVE as impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, but the public exploit is available on GitHub and other sites. The vulnerability is not listed in the CISA KEV catalog. It can be exploited remotely via a crafted HTTP request to servicetype.php with a malicious editid parameter. Attackers with network access can trigger SQL injection to compromise data.

Generated by OpenCVE AI on August 6, 2026 at 10:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑provided patch or upgrade to the latest release of itsourcecode Hospital Management System that resolves the SQL injection flaw.
  • Restrict access to the servicetype.php endpoint to authenticated and authorized users only; block or rate‑limit unauthenticated requests.
  • Implement input validation and or parameterized queries for the editid parameter to eliminate SQL injection opportunities.
  • Use least‑privilege database accounts for the application to limit the impact if injection occurs.
  • Monitor database logs for abnormal query patterns and alert on suspicious activity.

Generated by OpenCVE AI on August 6, 2026 at 10:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 08:15:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicetype.php. This manipulation of the argument editid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
Title itsourcecode Hospital Management System servicetype.php sql injection
First Time appeared Itsourcecode
Itsourcecode hospital Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode hospital Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Hospital Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-06T07:45:08.129Z

Reserved: 2026-08-05T21:33:16.164Z

Link: CVE-2026-19020

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T10:30:16Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')