CVE-2026-86302
Received Received - Intake

SQL Database Backup File Handler Information Disclosure in Hospital Information System

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A vulnerability was found in code-projects Hospital Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /HIS/his.sql of the component SQL Database Backup File Handler. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86302
EUVD
EUVD-2026-72355

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information disclosure issue in the Hospital Information System (HIS) version 1.0. An exposed SQL database backup file named his.sql is stored in a web-accessible directory, allowing unauthenticated users to download it via HTTP. The file may contain sensitive data like database schema, user credentials, patient records, or configuration details.

Detection Guidance
  • Check if /HIS/his.sql is accessible via HTTP by sending a GET request: curl -I http://<target-ip>/HIS/his.sql
  • Search web server directories for exposed .sql files using: find /var/www -name "*.sql"
  • Verify if sensitive files like his.sql are in web-accessible directories such as /var/www/html or /usr/local/apache2/htdocs
Impact Analysis

Attackers can exploit this to access sensitive information by downloading the his.sql file. This could lead to data breaches, unauthorized access to user accounts, exposure of internal database structures, or further attacks using revealed credentials or configurations.

Compliance Impact

This vulnerability likely violates compliance requirements such as GDPR (data protection) and HIPAA (patient privacy) due to unauthorized access to sensitive data. It could result in legal penalties, loss of trust, and regulatory fines for failing to protect personal or health information.

Mitigation Strategies
  • Remove his.sql from the web-accessible directory immediately to prevent further exposure.
  • Configure web server to block access to .sql files. For Apache, add: <FilesMatch "\.(sql|bak|backup)$"> Deny from all </FilesMatch>
  • For Nginx, add: location ~* \.(sql|bak|backup)$ { deny all; }
  • Review and restrict directory permissions to ensure no sensitive files are placed in web root.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86302. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart