CVE-2026-78112: SQL Injection in itsourcecode Hospital Management System Project in PHP

This vulnerability affects itsourcecode Hospital Management System Project in PHP version 1.0. The issue is located in an unknown function within the /viewservicetype.php file, where the 'delid' parameter is improperly sanitized, leading to SQL injection. The vulnerability can be exploited remotely without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the network attack vector, low attack complexity, and limited impact on confidentiality, integrity, and availability. Exploit code has been published, increasing the risk of exploitation.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact on confidentiality, integrity, and availability is limited but present. No evidence of active exploitation in the wild is reported.

No official patch or remediation is currently available. Users should monitor the vendor's advisory channels for updates. In the meantime, restricting access to the affected functionality and employing web application firewalls to detect and block SQL injection attempts may reduce risk.