CVE-2026-11501: SourceCodester Hospitals Patient Records Management System Master.php save_patient sql injection
A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=savepatient. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Hospitals Patient Records Management System 1.0from your environment.Uninstall or take the affected application offline until a vendor-provided fix or patch is available.
- Compensating control
Restrict access to the application and the vulnerable endpoint (/classes/Master.php?f=save_patient) to trusted IPs and/or deploy a Web Application Firewall (WAF) to block SQL injection attempts.
- Operational
Monitor logs for signs of exploitation of /classes/Master.php?f=save_patient, investigate any suspicious activity for possible compromise, and rotate any credentials or secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11501?
The severity of CVE-2026-11501 is high with a score of 7.3.
What type of vulnerability is CVE-2026-11501?
CVE-2026-11501 is classified as an SQL injection vulnerability.
How do I fix CVE-2026-11501?
To fix CVE-2026-11501, ensure that all user inputs are properly sanitized and validated to prevent SQL injection.
Can CVE-2026-11501 be exploited remotely?
Yes, CVE-2026-11501 can be exploited remotely due to its nature.
What file is affected by CVE-2026-11501?
CVE-2026-11501 affects the file /classes/Master.php specifically in the save_patient function.