Description
A vulnerability was determined in PHPGurukul Hospital Management System 4.0. This impacts an unknown function of the file /admin/manage-users.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-02-08
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Assess Impact
AI Analysis

Impact

This vulnerability allows an attacker to manipulate the ID parameter in the /admin/manage-users.php script of PHPGurukul Hospital Management System version 4.0, resulting in an uncontrolled SQL injection. The input is not validated or safely bound, permitting the execution of arbitrary SQL commands against the system’s database.

Affected Systems

The issue affects installations of PHPGurukul Hospital Management System version 4.0, specifically the /admin/manage-users.php functionality used for user management.

Risk and Exploitability

The CVSS score of 5.1 indicates medium severity. The EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attack can be initiated remotely by supplying a crafted ID value to the /admin/manage-users.php endpoint; authentication prerequisites are not specified in the description, so the risk depends on how exposed the endpoint is.

Generated by OpenCVE AI on April 18, 2026 at 19:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify if a vendor patch for the SQL injection in manage‑users.php has been released, and apply it immediately if available.
  • If no patch is available, incorporate input validation on the ID parameter – enforce numeric values or use a whitelist – and refactor the code to use prepared statements or stored procedures to eliminate injection.
  • Restrict the database account privileges used by the application to the minimum required, so that any injection cannot affect critical database objects or grant excessive permissions.

Generated by OpenCVE AI on April 18, 2026 at 19:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 10:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:phpgurukul:hospital_management_system:*:*:*:*:*:*:*:*

Tue, 10 Feb 2026 14:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:phpgurukul:hospital_management_system:4.0:*:*:*:*:*:*:*

Mon, 09 Feb 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 09 Feb 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Phpgurukul
Phpgurukul hospital Management System
Vendors & Products Phpgurukul
Phpgurukul hospital Management System

Sun, 08 Feb 2026 19:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in PHPGurukul Hospital Management System 4.0. This impacts an unknown function of the file /admin/manage-users.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Title PHPGurukul Hospital Management System manage-users.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Phpgurukul Hospital Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:47:56.418Z

Reserved: 2026-02-07T15:15:16.227Z

Link: CVE-2026-2179

cve-icon Vulnrichment

Updated: 2026-02-09T17:38:10.809Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-08T20:15:50.047

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-2179

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T19:45:08Z

Weaknesses