CVE-2026-85397 in Hospital Information System
Summary
by MITRE • 09/04/2026
A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.php. This manipulation of the argument Search causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The identified vulnerability in code-projects Hospital Information System version 1.0 represents a critical security flaw within its patient request management module, specifically located in the addReq.php file. This system is designed to handle sensitive healthcare data, making any compromise of its integrity particularly severe for patients and providers alike. The core issue resides in the findBySearch function, which processes user-supplied input through an SQL query without adequate sanitization or parameterization. When a user provides search criteria via the Search argument, the application directly concatenates this value into the database command string. This architectural oversight allows malicious actors to inject arbitrary Structured Query Language commands that are executed by the backend database server with the same privileges as the web application itself.
This specific flaw is classified under Common Weakness Enumeration (CWE) ID 89, which denotes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The vulnerability enables attackers to bypass authentication mechanisms, extract sensitive data such as patient records and staff credentials, modify or delete database entries, and potentially execute administrative operations on the underlying system depending on the database configuration. Because the attack vector is remote, it can be exploited over a network connection without requiring prior access to the application interface beyond what is publicly available through standard web requests. The presence of public exploit code further lowers the barrier for entry, allowing less sophisticated threat actors to leverage existing tools against this vulnerable instance rather than developing custom payloads from scratch.
The operational impact of this vulnerability extends far beyond simple data theft. In a healthcare context, the integrity and availability of information are paramount. An attacker could alter medical records, leading to incorrect diagnoses or treatments if such tampered data is acted upon by clinical staff. Furthermore, the ability to dump entire database tables poses a significant risk to patient privacy regulations like HIPAA in the United States or GDPR in Europe, potentially resulting in severe legal and financial penalties for the organization hosting the system. The remote nature of the exploit means that automated scanning tools can detect and compromise vulnerable instances at scale across the internet, leading to widespread breaches if left unpatched.
Mitigation strategies must focus on immediate remediation of the code flaw alongside broader security hardening measures. Developers should refactor the findBySearch function in addReq.php to utilize prepared statements with parameterized queries instead of string concatenation for building SQL commands. This approach ensures that user input is treated strictly as data rather than executable code, effectively neutralizing injection attempts regardless of their content. Additionally, implementing strict input validation and sanitization routines can provide a secondary layer of defense by rejecting unexpected characters or formats before they reach the database engine. From an infrastructure perspective, deploying a Web Application Firewall (WAF) configured with rules specific to SQLi patterns can help detect and block malicious requests in real-time while patches are being developed. Regular security audits and static code analysis should be integrated into the development lifecycle to prevent similar vulnerabilities from reoccurring in future updates of the Hospital Information System.