Description
A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of the component User Login Handler. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Published: 2026-08-19
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw lies within the User::login function of the Hospital Information System, where the email parameter is concatenated directly into an SQL query. An attacker can supply a crafted email string that injects arbitrary SQL, bypassing authentication and allowing them to read, modify, or delete patient data and other database contents. The potential impact includes exposure of highly sensitive medical information and compromise of data integrity.

Affected Systems

The affected product is code‑projects Hospital Information System, version 1.0. This release contains the vulnerable User::login code in its User Login Handler component.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, and because the injection can be triggered via the publicly accessible login endpoint, the attack is possible remotely. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but an exploit has been published and could be used by adversaries without additional credentials, potentially resulting in unauthorized data access or manipulation.

Generated by OpenCVE AI on August 20, 2026 at 11:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch or upgrade to a version that removes the vulnerable code.
  • If a patch is unavailable, restrict access to the login endpoint using IP whitelisting or a web‑application firewall.
  • Refactor the login routine to use parameterized queries or an ORM that automatically escapes inputs.
  • Conduct a thorough code review for other potential injection points and reinforce input validation throughout the application.

Generated by OpenCVE AI on August 20, 2026 at 11:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of the component User Login Handler. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Title code-projects Hospital Information System User Login UsersController.php login sql injection
First Time appeared Code-projects
Code-projects hospital Information System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:hospital_information_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects hospital Information System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Hospital Information System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-25T14:01:32.167Z

Reserved: 2026-08-19T13:50:54.707Z

Link: CVE-2026-76574

cve-icon Vulnrichment

Updated: 2026-08-25T14:01:24.217Z

cve-icon NVD

Status : Deferred

Published: 2026-08-19T20:17:23.830

Modified: 2026-08-25T14:16:53.667

Link: CVE-2026-76574

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T12:00:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')