CVE-2026-11514: itsourcecode Hospital Management System addpatient.php sql injection
A flaw has been found in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /addpatient.php. This manipulation of the argument admissiontme causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
itsourcecode Hospital Management Systemfrom your environment.If the addpatient functionality is not required, disable or remove /addpatient.php or uninstall the application until the code is fixed.
- Configuration
Modify /addpatient.php to use prepared statements/parameterized queries for any database operations that use the admissiontme parameter. Implement server-side validation and sanitization for admissiontme (enforce expected format, length and allowed characters) and reject malformed input.
itsourcecode Hospital Management System (addpatient.php) admissiontme input handling = use parameterized queries; validate and sanitize input - Compensating control
Deploy a Web Application Firewall (WAF) or intrusion prevention rules to detect and block SQL injection attempts targeting /addpatient.php (including the admissiontme parameter). Where possible, restrict access to /addpatient.php to trusted IP ranges or internal networks.
- Operational
Search application and web server logs for signs of exploitation of /addpatient.php (admissiontme parameter). If compromise is suspected, perform incident response actions such as containing the system, restoring from known-good backups, and rotating any potentially exposed credentials.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11514?
The severity of CVE-2026-11514 is rated as medium with a score of 6.3.
How do I fix CVE-2026-11514?
To fix CVE-2026-11514, validate and sanitize user input in the addpatient.php file to prevent SQL injection.
What software is affected by CVE-2026-11514?
CVE-2026-11514 affects the itsourcecode Hospital Management System version 1.0.
Can CVE-2026-11514 be exploited remotely?
Yes, CVE-2026-11514 can be exploited remotely through the manipulation of the admissiontme argument.
What type of vulnerability is CVE-2026-11514?
CVE-2026-11514 is classified as an SQL Injection vulnerability.