CVE-2026-85399 in Hospital Information System
Summary
by MITRE • 09/04/2026
A security flaw has been discovered in code-projects Hospital Information System 1.0. Affected by this vulnerability is the function getSinglePresp of the file includes/presp/PrespController.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The code-projects Hospital Information System version 1.0 contains a critical security vulnerability within its prescription management module, specifically located in the getSinglePresp function of the includes/presp/PrespController.php file. This flaw represents an SQL injection weakness that arises from insufficient input validation and sanitization when processing user-supplied data. The system fails to properly escape or parameterize the ID argument before incorporating it into database queries, allowing malicious actors to inject arbitrary Structured Query Language commands directly into the backend database engine.
This vulnerability is classified under CWE-89, which denotes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The root cause lies in the direct concatenation or interpolation of the ID parameter without adequate safeguards such as prepared statements or strict type casting. Because the application relies on dynamic query construction using unsanitized input, attackers can manipulate the structure of the underlying database queries to bypass authentication mechanisms, extract sensitive data, modify existing records, or even execute administrative operations depending on the privileges assigned to the database user account associated with the web application.
The operational impact of this vulnerability is severe due to its remote exploitability and the nature of the affected system. As a Hospital Information System, it handles highly sensitive patient health information including medical histories, prescription details, personal identifiers, and billing records. An attacker leveraging this SQL injection can perform data exfiltration on a massive scale, potentially leading to significant privacy breaches and regulatory non-compliance with standards such as HIPAA or GDPR. Furthermore, depending on the database configuration, advanced exploitation techniques could allow for server-side request forgery, denial of service conditions through resource exhaustion, or even remote code execution if specific database features like xp_cmdshell are enabled in Microsoft SQL Server environments.
The threat landscape is exacerbated by the fact that an exploit has already been released to the public domain. This availability lowers the barrier to entry for less sophisticated attackers who may utilize automated scanning tools or pre-built scripts to identify and compromise vulnerable instances across the internet. The remote nature of the attack means no prior authentication or physical access is required, making it a high-risk vector for widespread exploitation against organizations that have not yet patched their systems or implemented compensating controls.
To mitigate this vulnerability, immediate remediation actions are necessary at both the application code level and infrastructure layer. Developers must refactor the getSinglePresp function to utilize parameterized queries or prepared statements, ensuring that all user inputs are treated strictly as data rather than executable code. Input validation should also be implemented to enforce strict type checking for the ID field, rejecting any input that does not match expected integer formats. Additionally, deploying a Web Application Firewall can provide an additional layer of defense by detecting and blocking common SQL injection patterns in HTTP requests before they reach the application logic. Regular security audits and static code analysis tools should be integrated into the development lifecycle to prevent similar flaws from being introduced in future updates.