CVE-2026-85399: SQL Injection in code-projects Hospital Information System

This vulnerability affects code-projects Hospital Information System version 1.0. The getSinglePresp function in includes/presp/PrespController.php improperly handles the ID argument, enabling an attacker to perform SQL injection remotely. The vulnerability is publicly disclosed with an exploit released. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impact as per the CVSS vector. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected function or employing web application firewalls to detect and block SQL injection attempts targeting the ID parameter.