CVE-2026-9356: SourceCodester Hospitals Patient Records Management System manage_history.php sql injection
A vulnerability has been found in SourceCodester Hospitals Patient Records Management System 1.0. This affects an unknown function of the file /admin/patients/managehistory.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Hospitals Patient Records Management System 1.0from your environment.If a vendor patch is not immediately available, disable or uninstall the affected application or take the /admin interface (or the web application) offline until the vulnerable code is fixed.
- Configuration
Do not concatenate the ID argument into SQL. Enforce server-side validation (ensure numeric type, length limits), escape or validate input, and convert queries to use prepared statements or parameterized queries to eliminate SQL injection.
/admin/patients/manage_history.php (SourceCodester Hospitals Patient Records Management System 1.0) ID parameter handling = validate and use parameterized queries / prepared statements - Compensating control
Apply network and perimeter controls until the application is fixed: restrict access to /admin/patients/manage_history.php to trusted IP addresses, place a Web Application Firewall (WAF) rule to block SQL injection payloads, and limit public exposure of the admin interface.
- Operational
Review logs for evidence of exploitation and investigate potential compromise. If compromise is suspected, rotate any credentials that may have been exposed and restore affected systems from known-good backups.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9356?
The severity of CVE-2026-9356 is rated high with a score of 7.3.
How do I fix CVE-2026-9356?
To fix CVE-2026-9356, you should patch the SourceCodester Hospitals Patient Records Management System to the latest version that addresses the SQL injection vulnerability.
What type of vulnerability is CVE-2026-9356?
CVE-2026-9356 is classified as a SQL injection vulnerability.
Can CVE-2026-9356 be exploited remotely?
Yes, CVE-2026-9356 can be exploited remotely through manipulation of the argument ID in the manage_history.php file.
What impact does CVE-2026-9356 have on system integrity?
CVE-2026-9356 can potentially affect data confidentiality and integrity due to SQL injection capabilities.