SQL Injection Vulnerability in Hospital Information System 1.0

Hospital Information System version 1.0 contains a critical SQL injection vulnerability identified as CVE-2026-85397. The flaw resides in the findBySearch function within the addReq.php file. An unauthenticated remote attacker can exploit this by injecting malicious SQL payloads into the Search argument processed by the web application. Successful exploitation could lead to unauthorized database access, data exfiltration, or complete database compromise. As the exploit has been publicly disclosed and is available for use, the risk to organizations running this specific version is significant. Defenders must prioritize identifying and securing any internet-facing instances of this legacy software.

Attack Chain

1. Attacker performs reconnaissance to identify web servers running Hospital Information System 1.0.
2. Attacker probes for the addReq.php file on the target server.
3. Attacker identifies the Search parameter as a target for injection.
4. Attacker crafts a malicious HTTP GET or POST request containing SQL injection syntax in the Search field.
5. The application passes the unsanitized input to the database query engine.
6. The database executes the injected SQL command.
7. Attacker retrieves unauthorized data or modifies database records.

Impact

The vulnerability affects instances of the Hospital Information System 1.0, typically used within healthcare-related information management contexts. Successful exploitation enables unauthorized access to sensitive healthcare data stored within the backend database. Given the nature of hospital information systems, this could result in widespread exposure of patient records, violation of data privacy regulations, and operational disruption.

Recommendation

• Identify all deployments of Hospital Information System 1.0 within the environment.
• Implement a Web Application Firewall (WAF) rule to inspect and block requests containing SQL syntax or common injection patterns (such as ' or -- or UNION SELECT) directed at addReq.php.
• Deploy the Sigma rule below to detect potential exploitation attempts via web server logs.
• If a patch is not available from the vendor, isolate the affected application behind an authenticated reverse proxy or disable access to the addReq.php file.