SourceCodester Hospitals Patient Records Management System view_history.php sql injection

Vulnerability

The vulnerability is an SQL injection in the file /admin/patients/view_history.php of SourceCodester Hospitals Patient Records Management System version 1.0. The id parameter is directly used in SQL queries without sanitization, allowing injection of malicious SQL. Affected version: V1.0. [1]

Exploitation

The attack can be launched remotely without authentication. An attacker sends a crafted GET request to /admin/patients/view_history.php with a malicious id parameter. The exploit has been publicly released, including a proof-of-concept payload for boolean-based blind SQL injection. [1]

Impact

Successful exploitation allows unauthorized database access, sensitive data leakage, data tampering, and potentially full system control. The attacker can read, modify, or delete database contents, leading to serious security compromise. [1]

Mitigation

As of the publication date (2026-05-23), no official patch has been released. The vendor (SourceCodester) has not provided a fix. Users should consider disabling the vulnerable page or implementing input validation and parameterized queries. The product may be EOL or unsupported. [1]