SQL Injection Vulnerability in Hospital Management System

The kishan0725 Hospital Management System is vulnerable to a remote SQL injection vulnerability (CVE-2026-111990) due to improper input sanitization in the 'admin-panel.php' file. The vulnerability specifically resides within the 'Appointment Cancellation Handler' component, where the 'ID' argument passed to the 'mysqli_query' function is insufficiently validated. An unauthenticated remote attacker can supply malicious SQL queries through this argument to interact with the underlying database. The vulnerability has been confirmed with public exploit code available, and the project maintainers have not yet addressed the issue. Defenders should prioritize restricting access to the management interface and monitoring for anomalous SQL patterns originating from web traffic.

Attack Chain

1. Attacker performs reconnaissance to identify instances of the Hospital Management System exposed to the internet.
2. Attacker locates the 'admin-panel.php' endpoint within the target web application.
3. Attacker crafts a malicious HTTP GET or POST request targeting the 'ID' parameter associated with the Appointment Cancellation Handler.
4. Attacker injects SQL syntax into the 'ID' parameter value, such as single quotes or UNION-based select statements.
5. The application passes the unsanitized input directly into the 'mysqli_query' function.
6. The database executes the malicious query, allowing the attacker to bypass authentication, dump sensitive patient data, or modify database content.
7. Attacker achieves unauthorized data access or persistence within the application's backend database.

Impact

Successful exploitation allows remote, unauthenticated attackers to gain unauthorized access to the database. Given the nature of a hospital management system, this impact includes potential exfiltration of sensitive patient information, administrative credential theft, or complete compromise of the application backend. As of the report, no vendor patch is available for versions up to the current repository state (777fda46b77a820977a5ba616283dbfbc40bf7e1).

Recommendation

• Monitor web server logs for HTTP requests to 'admin-panel.php' containing suspicious SQL syntax (e.g., 'UNION', 'SELECT', 'OR 1=1', '--') in the 'ID' parameter.
• Restrict network access to the 'admin-panel.php' endpoint using a Web Application Firewall (WAF) or by moving the administrative interface to an internal, non-public network.
• Since no patch is currently available, consider disabling the vulnerable Appointment Cancellation Handler if it is not business-critical.