CVE-2026-9355: SourceCodester Hospitals Patient Records Management System Master.php save_patient_history sql injection
A flaw has been found in SourceCodester Hospitals Patient Records Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=savepatienthistory. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Hospitals Patient Records Management System 1.0from your environment.If the application is not required, uninstall/remove SourceCodester Hospitals Patient Records Management System 1.0 from affected hosts until a secure fix is available.
- Configuration
Block or restrict access to /classes/Master.php?f=save_patient_history at the web server or reverse proxy (deny requests to this endpoint) until a secure code fix is implemented.
/classes/Master.php?f=save_patient_history (web application endpoint) access = blocked/limited - Configuration
Modify the code in /classes/Master.php?f=save_patient_history to validate and sanitize the 'ID' parameter and use parameterized/prepared statements (or equivalent safe database APIs) to eliminate SQL injection.
Application code ID parameter input handling = parameterized queries and input validation - Compensating control
Deploy a WAF/IPS rule to detect and block SQL injection attempts against the 'ID' parameter and this endpoint; if possible, restrict access to the application to trusted IPs or internal network only.
- Operational
Search logs and audit access for exploitation attempts against /classes/Master.php?f=save_patient_history and the 'ID' parameter; if suspicious activity or compromise is found, perform incident response (containment, eradication) and rotate any credentials that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9355?
The severity of CVE-2026-9355 is categorized as high, with a CVSS score of 7.3.
How do I fix CVE-2026-9355?
To fix CVE-2026-9355, ensure to sanitize and validate all user inputs in the Master.php file to prevent SQL injection attacks.
What type of vulnerability is CVE-2026-9355?
CVE-2026-9355 is classified as an SQL Injection vulnerability.
Can CVE-2026-9355 be exploited remotely?
Yes, CVE-2026-9355 can be exploited remotely due to the nature of the SQL injection flaw.
Which software is affected by CVE-2026-9355?
CVE-2026-9355 affects the SourceCodester Hospitals Patient Records Management System version 1.0.