CVE-2026-10209

Vulnerability

A SQL injection vulnerability exists in the appointmentdetail.php file of code-projects Online Hospital Management System version 1.0. The editid parameter is passed directly into SQL queries without proper sanitization or validation, enabling attackers to inject malicious SQL statements. The vulnerable file is part of the Appointment Handler component. [2]

Exploitation

An attacker can exploit this vulnerability remotely without requiring authentication or any prior authorization. By sending a crafted GET request with a malicious editid parameter, the attacker can perform boolean-based blind SQL injection. The payload example includes editid=1' R... to manipulate the query. The exploit has been publicly disclosed, increasing the risk of active attacks. [2]

Impact

Successful exploitation allows an attacker to gain unauthorized access to the database, leading to sensitive data leakage, data tampering, and potential full system control. The attacker can read, modify, or delete arbitrary data, and may cause service interruption. The impact is severe for confidentiality, integrity, and availability of the application and its data. [2]

Mitigation

As of the publication date, no official patch or fixed version has been released by the vendor. The affected version is Online Hospital Management System 1.0. Users should consider implementing input validation and parameterized queries for the editid parameter, or restrict access to the appointmentdetail.php file until a patch is available. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of this writing. [2]