CVE-2026-10185 in Hospitals Patient Records Management System
Summary
by MITRE • 05/31/2026
A weakness has been identified in SourceCodester Hospitals Patient Records Management System 1.0. Affected is an unknown function of the file /classes/Users.php?f=save. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/31/2026
The vulnerability identified in SourceCodester Hospitals Patient Records Management System version 1.0 represents a critical sql injection flaw that undermines the system's data integrity and security posture. This weakness manifests within the /classes/Users.php file through the f=save endpoint where user-supplied ID parameters are inadequately sanitized before being incorporated into database queries. The vulnerability classification aligns with CWE-89 which specifically addresses sql injection vulnerabilities where untrusted data is directly concatenated into sql command strings without proper input validation or parameterization.
The technical implementation of this vulnerability allows remote attackers to manipulate the ID argument parameter to execute arbitrary sql commands against the underlying database system. When the application processes the f=save function with an attacker-controlled ID value, the application fails to implement proper input sanitization or parameterized queries, creating an exploitation vector that enables unauthorized database access. This flaw operates at the application layer and leverages the inherent trust relationship between the web application and its database backend, potentially allowing attackers to extract sensitive patient information, modify database records, or even escalate privileges within the system.
The operational impact of this vulnerability extends beyond simple data theft to encompass potential system compromise and regulatory compliance violations. Given that this is a healthcare management system handling patient records, successful exploitation could lead to unauthorized access to protected health information, violating regulations such as hipaa and gdpr. The remote exploitability of this vulnerability means that attackers do not require physical access to the system or network, making the attack surface significantly broader. The public availability of exploit code further amplifies the risk, as it enables automated attacks and reduces the technical expertise required to compromise the system.
Mitigation strategies should prioritize immediate implementation of input validation and parameterized query approaches to address the root cause of the vulnerability. The system administrators should implement proper input sanitization measures that validate and filter all user-supplied data before processing, particularly focusing on the ID parameter within the f=save function. Additionally, the implementation of web application firewalls and database access controls can provide additional defense-in-depth layers. Regular security assessments and code reviews should be conducted to identify similar vulnerabilities within the application codebase, while the system should be updated to the latest available version that addresses this specific vulnerability. The remediation efforts should align with industry best practices outlined in the owasp top ten and mitre attack framework, specifically addressing the sql injection techniques that leverage the application's trust relationship with its database backend.