SQL Injection Vulnerability in Hospital Information System 1.0

A critical SQL injection vulnerability, tracked as CVE-2026-76574, has been identified in version 1.0 of the code-projects Hospital Information System. The vulnerability exists within the 'User::login' function located in 'includes/users/UsersController.php'. An unauthenticated, remote attacker can exploit this flaw by supplying malicious SQL payloads through the 'email' argument during the authentication process. Successful exploitation allows an attacker to execute arbitrary SQL commands against the underlying database, potentially resulting in the unauthorized disclosure of sensitive patient information, data modification, or complete compromise of the application's database backend. Publicly available exploit code exists, increasing the risk of active exploitation.

Impact

The vulnerability affects the Hospital Information System 1.0, a software platform used in clinical or administrative healthcare environments. Successful exploitation may result in a complete breach of confidentiality and integrity of the data stored within the system, potentially exposing patient health information (PHI) and administrative records. Given the sensitivity of the data handled by hospital systems, the impact of unauthorized access is significant.

Recommendation

Prioritize the immediate decommissioning or patching of all instances of Hospital Information System 1.0. If the product cannot be updated or patched, ensure the application is removed from internet-facing segments immediately. Deploy Web Application Firewall (WAF) rules to inspect incoming HTTP requests for SQL injection signatures specifically targeting the 'email' parameter of login endpoints. Monitor web server access logs for anomalous payloads containing SQL keywords (e.g., SELECT, UNION, SLEEP, WAITFOR) within POST parameters to the identified login URI.