VYPR
patchPublished Aug 17, 2026· 1 source

Six SQLi Flaws in Itsourcecode Hospital Management System 1.0 Disclosed with Public Exploits

Key findings • Six medium-severity SQL injection vulnerabilities disclosed for Itsourcecode Hospital Management System 1.0. • All vulnerabilities stem from the manipulation of the 'delid' arg…

Key findings

  • Six medium-severity SQL injection vulnerabilities disclosed for Itsourcecode Hospital Management System 1.0.
  • All vulnerabilities stem from the manipulation of the 'delid' argument in various PHP files.
  • Publicly available exploits exist for all disclosed CVEs, increasing immediate risk.
  • Affected files include viewprescriptionrecord.php, viewpaymentreport.php, viewpatient.php, vieworder.php, viewmedicine.php, and viewdoctortimings.php.
  • The disclosure window spanned three days from August 14-17, 2026.

On August 14-17, 2026, a batch of six medium-severity SQL injection vulnerabilities was disclosed for the Itsourcecode Hospital Management System (HMS) version 1.0. These vulnerabilities, all stemming from the manipulation of the 'delid' argument in various PHP files, allow for remote exploitation and have publicly available exploits.

The affected files and their corresponding CVEs are:

All six vulnerabilities share the same root cause: improper handling of the 'delid' parameter, leading to SQL injection. This means an attacker can interfere with the queries an application makes to its database. In this case, the 'delid' parameter, likely intended for deletion operations, is vulnerable when manipulated. The consistent CVSSv3 score of 6.3 for all CVEs indicates a medium severity, but the widespread availability of exploits elevates the risk for any organization running the affected version.

The disclosure window spanned three days, with the earliest on August 14th (CVE-2026-19767) and the latest on August 17th (CVE-2026-20000, CVE-2026-19973, CVE-2026-19972). The consistent reporting of public exploits across these disclosures suggests a coordinated or at least closely timed release of information, potentially by a single researcher or group.

The Itsourcecode Hospital Management System 1.0 is directly impacted by these flaws. Given the sensitive nature of patient records, successful exploitation could lead to unauthorized access, modification, or deletion of critical health information. The remote nature of the attacks means that systems exposed to the internet are particularly at risk.

As of the disclosure, all identified vulnerabilities have publicly available exploits, increasing the urgency for users to update their systems. Itsourcecode has not yet released specific patches for this batch of vulnerabilities, and users are advised to consult the vendor for any available workarounds or mitigation strategies. The consistent pattern of SQL injection vulnerabilities across multiple files in version 1.0 highlights a significant security weakness that needs immediate attention from Itsourcecode's customers.

Organizations using Itsourcecode Hospital Management System 1.0 should prioritize investigating their exposure to these vulnerabilities. The availability of public exploits means that opportunistic attackers could target these systems. A thorough security audit and prompt application of any available vendor patches or security advisories are crucial to protect sensitive patient data. The consistent nature of these SQL injection flaws suggests a need for a comprehensive review of the system's security architecture.

Synthesized by Vypr AI