| Title | code-projects Hospital Information System in PHP 1.0 SQL Injection |
|---|
| Description | The Hospital Information System in PHP is affected by an injection vulnerability within the prescription update functionality implemented by /HIS/includes/presp/PrespController.php.
The affected endpoint processes the updatePrespc operation and accepts several user-controlled POST parameters, including id, in_Name, in_Expiry, in_Presp, in_Price, and in_Qty.
Testing identified in_Name as the affected parameter.
The application does not appear to adequately neutralize specially crafted content supplied through this field before passing the value to downstream processing. During testing, values containing a sleep expression caused distinguishable application behavior.
The tested values were:
a;sleep(1)
and:
a;sleep(10000)
The first test can be represented in URL-encoded form as:
in_Name=a%3bsleep(1)
The observed difference between requests indicates that the supplied value is not handled exclusively as ordinary prescription-name data and may influence a downstream query or interpreter.
If PrespController.php constructs database queries by incorporating in_Name directly into query syntax without parameter binding, specially crafted input may alter the intended database operation. This results from a failure to maintain a strict separation between untrusted application data and instructions interpreted by a downstream component.
Depending on the backend technology and affected query context, successful exploitation could allow an attacker to interfere with database operations associated with prescription management.
The precise database-specific classification should be determined from the implementation of PrespController.php. If the application incorporates in_Name directly into an SQL statement without parameterization, the issue constitutes SQL Injection under CWE-89.
|
|---|
| Source | ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Hospital%20Information%20System%20in%20PHP%20%E2%80%93%20No%20SQL%20Injection%20Vulnerability%20in%20%60PrespController.php%60%20via%20%60in_Name%60%20Parameter.md |
|---|
| User | AhmadMarzouk (UID 95993) |
|---|
| Submission | 07/27/2026 20:28 (1 month ago) |
|---|
| Moderation | 09/06/2026 18:37 (1 month later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 398542 [code-projects Hospital Information System 1.0 PrespController.php getSinglePresp ID sql injection] |
|---|
| Points | 0 |
|---|