A vulnerability was identified in code-projects Hospital Information System 1.0. (CVE-2026-85398)

The vulnerability identified as CVE-2026-85398 affects code-projects Hospital Information System 1.0 specifically in the viewReq function of the viewReq.php file. Manipulation of the ID parameter leads to a SQL injection (CWE-74), allowing remote attackers to execute unauthorized SQL commands. The vulnerability has a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating it is remotely exploitable without privileges or user interaction and can impact confidentiality, integrity, and availability to a limited extent. Public exploit code exists, but no active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database remotely, potentially leading to unauthorized data disclosure, modification, or deletion. The impact affects confidentiality, integrity, and availability at a low to moderate level as per the CVSS vector. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to apply input validation and sanitization on the ID parameter to prevent SQL injection. Monitor official sources for updates or patches from the vendor.