CVE-2026-11501
Deferred Deferred - Pending Action
SQL Injection in Hospitals Patient Records Management System

Publication date: 2026-06-08

Last updated on: 2026-06-08

Assigner: VulDB

Description
A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=save_patient. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-08
Last Modified
2026-06-08
Generated
2026-06-08
AI Q&A
2026-06-08
EPSS Evaluated
N/A
NVD
CVE-2026-11501
EUVD
EUVD-2026-35035
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
sourcecodester hospitals_patient_records_management_system 1.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-11501 is a critical SQL injection vulnerability found in the Hospital's Patient Records Management System version 1.0. The flaw exists in the file `/classes/Master.php?f=save_patient` due to insufficient input validation of the 'id' parameter. This allows attackers to inject malicious SQL queries remotely without needing authentication.

The vulnerability was confirmed using tools like sqlmap, demonstrating a boolean-based blind SQL injection via the 'id' parameter.

Impact Analysis

Exploitation of this vulnerability can lead to unauthorized access to the database, resulting in data leakage, tampering with patient records, gaining control over the system, and disruption of services.

Detection Guidance

This vulnerability can be detected by testing the 'id' parameter in the /classes/Master.php?f=save_patient endpoint for SQL injection flaws.

Tools like sqlmap can be used to confirm the presence of boolean-based blind SQL injection via the 'id' parameter.

  • Use sqlmap with a command similar to: sqlmap -u "http://target/classes/Master.php?f=save_patient&id=1" --batch --dbs
  • Manually test by injecting SQL payloads into the 'id' parameter and observing responses for anomalies or errors.
Mitigation Strategies

Immediate mitigation steps include implementing prepared statements and strict input validation on the 'id' parameter to prevent SQL injection.

Minimize database user permissions to limit the impact of a potential exploit.

Conduct regular security audits to identify and fix similar vulnerabilities.

Since no official patches are available at the time of disclosure, consider applying temporary web application firewall (WAF) rules to block malicious input patterns targeting the 'id' parameter.

Compliance Impact

The SQL injection vulnerability in the Hospital's Patient Records Management System allows unauthorized access, data leakage, and tampering with sensitive patient data.

Such unauthorized access and potential data breaches can lead to non-compliance with data protection regulations like GDPR and HIPAA, which mandate the protection of personal and health information.

Failure to secure patient records against such vulnerabilities may result in violations of confidentiality, integrity, and availability requirements imposed by these standards.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11501. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart