CVE-2026-10185: SourceCodester Hospitals Patient Records Management System Users.php save sql injection

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Remove

   Remove SourceCodester Hospitals Patient Records Management System 1.0 from your environment.

   If the application is not required, uninstall or remove the affected application instance to eliminate the vulnerable component from the environment.

2. Configuration

   Ensure the ID argument accepted by /classes/Users.php?f=save is strictly validated (e.g., cast or reject non-numeric input) and convert any dynamic SQL to use parameterized queries or prepared statements to eliminate SQL injection.

   SourceCodester Hospitals Patient Records Management System 1.0 - /classes/Users.php?f=save ID parameter handling / SQL query = validate ID as an integer and use parameterized queries / prepared statements
3. Compensating control

   If a code patch cannot be applied immediately, restrict access to the application (and the /classes/Users.php endpoint) by network controls such as firewall rules, IP allowlists, or a web application firewall (WAF) to limit exposure to untrusted networks.

4. Operational

   Because a public exploit exists, assume possible compromise: review access and database logs for suspicious activity, investigate indicators of compromise, and rotate any credentials (application, database, administrative) that may have been exposed before or during remediation.

Event History

Frequently Asked Questions