CVE-2026-111990: SQL Injection in kishan0725 Hospital Management System

This vulnerability affects the kishan0725 Hospital Management System up to commit 777fda46b77a820977a5ba616283dbfbc40bf7e1. The issue is in the admin-panel.php file's Appointment Cancellation Handler, specifically in the mysqli_query function. By manipulating the ID parameter, an attacker can perform SQL injection remotely without any privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). Although the issue was reported early, the project has not responded or provided a patch. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation allows an unauthenticated remote attacker to perform SQL injection attacks via the ID parameter in the Appointment Cancellation Handler. This can lead to unauthorized data access or modification with limited confidentiality, integrity, and availability impact as indicated by the CVSS vector. The availability of public exploit code increases the likelihood of attacks.

No official fix or patch is currently available as the vendor has not responded. Users should monitor the vendor's communications for updates. Until a patch is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in admin-panel.php. Restricting access to the admin panel and input validation may reduce risk but are not complete mitigations.