CVE-2026-11513: itsourcecode Hospital Management System adminaccount.php sql injection
A vulnerability was detected in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /adminaccount.php. The manipulation of the argument Date results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
itsourcecode Hospital Management System /adminaccount.phpfrom your environment.If the /adminaccount.php page is not required, disable or remove it from the web server to eliminate the vulnerable entry point.
- Configuration
Modify /adminaccount.php so the Date argument is validated/sanitized and database access uses prepared statements/parameterized queries (avoid concatenating user input into SQL) to eliminate the SQL injection.
itsourcecode Hospital Management System (/adminaccount.php) Date parameter handling = use parameterized queries; validate and sanitize input - Compensating control
Block or restrict remote access to /adminaccount.php at the network perimeter (firewall, access control) and/or deploy WAF rules to detect and block SQL injection attempts targeting the Date parameter until code is fixed.
- Operational
Search web server and database logs for suspicious requests targeting /adminaccount.php and the Date parameter, and investigate any signs of exploitation; perform incident response and remediation if compromise is found.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11513?
The severity of CVE-2026-11513 is classified as medium, with a CVSS score of 6.3.
What type of vulnerability is CVE-2026-11513?
CVE-2026-11513 is an SQL injection vulnerability affecting the adminaccount.php file in the itsourcecode Hospital Management System.
How do I fix CVE-2026-11513?
To fix CVE-2026-11513, validate and sanitize inputs for the Date argument to prevent SQL injection.
Is CVE-2026-11513 exploitable remotely?
Yes, CVE-2026-11513 can be exploited remotely.
What functions are affected by CVE-2026-11513?
An unknown function in the file /adminaccount.php is affected by CVE-2026-11513.