CVE-2026-8785

Vulnerability

Description A critical SQL injection vulnerability exists in Project Worlds Hospital Management System 1.0. The flaw is located in the file update_info.php, specifically in the getAllPatientDetail function which directly concatenates the appointment_no GET parameter into a SQL query without proper sanitization. The application's secure() function only applies htmlentities(), which is insufficient to prevent SQL injection in numeric contexts [1]. Additionally, the access control relies on a JavaScript redirect without calling exit(), allowing the server to process the query even for unauthenticated users [2].

Exploitation

An attacker can exploit this vulnerability remotely without authentication by sending a crafted GET request to update_info.php with a malicious appointment_no parameter. The proof of concept demonstrates time-based SQL injection payloads that can be used to extract data [1]. The exploit has been publicly published, increasing the risk of active attacks.

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands, leading to unauthorized access to sensitive patient records, including personal and medical data. In a broader context, it can enable full database compromise, potentially exposing all stored information [1][2].

Mitigation

Status The vendor was notified via an issue report but has not responded or released a patch [2]. As of the publication date, no official fix is available. Users should consider disabling access to update_info.php or implementing proper input validation and parameterized queries.