Description
A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /treatment.php. Performing a manipulation of the argument editid results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Published: 2026-08-06
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in itsourcecode Hospital Management System version 1.0 allows an attacker to inject arbitrary SQL through the editid parameter in treatment.php, leading to unauthorized database access and data tampering. The vulnerability is a classic input validation weakness (CWE-74) compounded by SQL injection (CWE-89), enabling changes to patient records, extraction of sensitive data, and potential further escalation if the database is privileged.

Affected Systems

The affected product is itsourcecode Hospital Management System, specifically the treatment.php component in version 1.0. No other versions or products are listed as impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, but the vulnerability has a public exploit available, suggesting a realistic attack likelihood. It is not listed in the CISA KEV catalog yet, but the presence of released payloads makes it a potential threat for systems that have not applied a patch or mitigated the input flaw.

Generated by OpenCVE AI on August 7, 2026 at 00:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor‑issued patch or update to Hospital Management System 1.0 that fixes the editid injection issue.
  • If no official fix is available, restrict or remove external access to the editid parameter on treatment.php and enforce strict input validation using parameterized queries.
  • Monitor database and web server logs for suspicious query patterns and implement a web‑application firewall rule to block common SQL‑injection payloads.

Generated by OpenCVE AI on August 7, 2026 at 00:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 08 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 06 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /treatment.php. Performing a manipulation of the argument editid results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Title itsourcecode Hospital Management System treatment.php sql injection
First Time appeared Itsourcecode
Itsourcecode hospital Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode hospital Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Hospital Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-08T02:24:22.763Z

Reserved: 2026-08-06T08:56:42.511Z

Link: CVE-2026-19067

cve-icon Vulnrichment

Updated: 2026-08-08T02:24:18.571Z

cve-icon NVD

Status : Deferred

Published: 2026-08-06T22:16:54.110

Modified: 2026-08-12T21:00:37.147

Link: CVE-2026-19067

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T00:30:06Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')