CVE-2026-10184: Hospital Records Management SQL Injection

CVE-2026-10184 Overview

CVE-2026-10184 is a SQL injection vulnerability in SourceCodester Hospitals Patient Records Management System 1.0. The flaw exists in the /classes/Users.php?f=delete endpoint, where the ID parameter is passed to a backend SQL query without proper sanitization. Remote attackers can manipulate the ID argument to inject arbitrary SQL statements. The issue is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output). Public exploit details have been released, increasing the likelihood of opportunistic abuse against exposed deployments.

Critical Impact
Unauthenticated remote attackers can inject SQL through the ID parameter of /classes/Users.php?f=delete, potentially altering or extracting data from the patient records database.

Affected Products

SourceCodester Hospitals Patient Records Management System 1.0
Deployments exposing /classes/Users.php to untrusted networks
Forks or derivative projects reusing the vulnerable Users.php delete handler

Discovery Timeline

2026-05-31 - CVE-2026-10184 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10184

Vulnerability Analysis

The vulnerability resides in the user deletion handler reached through /classes/Users.php?f=delete. The ID request argument flows into a SQL statement without parameterization or input validation. An attacker can append SQL syntax to the parameter, breaking out of the original query context and executing attacker-controlled clauses. Because the endpoint is reachable over the network and requires no authentication, exploitation can be automated against any exposed instance. The application processes patient and user records, so successful injection can expose protected health information or modify account state.

Root Cause

The root cause is unsafe concatenation of user-supplied input into a SQL query string within the delete action of Users.php. The codebase does not use prepared statements or bound parameters for the ID value, and no allowlist or type coercion is applied before query execution.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker issues an HTTP request to /classes/Users.php?f=delete with a crafted ID parameter containing SQL metacharacters. The injected payload is concatenated into the deletion query, allowing the attacker to alter query logic, read additional rows, or modify records. Refer to the GitHub Issue Discussion and VulDB CVE Details for proof-of-concept context.

Detection Methods for CVE-2026-10184

Indicators of Compromise

HTTP requests to /classes/Users.php?f=delete containing SQL metacharacters such as single quotes, UNION, SLEEP(, or comment sequences (--, #) in the ID parameter.
Web server access logs showing unauthenticated POST or GET requests to the delete endpoint from unfamiliar source IPs.
Unexpected DELETE or SELECT statements in MySQL general or slow query logs originating from the application user.
Anomalous record removals or modifications in the users table without a corresponding administrator session.

Detection Strategies

Deploy web application firewall signatures that flag SQL metacharacters in the ID parameter on the Users.php path.
Enable database query logging and alert on DELETE statements that include OR, UNION, or boolean tautologies.
Correlate authentication events with delete operations to identify unauthenticated abuse.

Monitoring Recommendations

Forward web server, PHP-FPM, and MySQL logs to a centralized analytics platform for correlation.
Baseline normal request rates to /classes/Users.php and alert on volume or payload anomalies.
Track outbound database errors returned to clients, which often indicate injection probing.

How to Mitigate CVE-2026-10184

Immediate Actions Required

Restrict access to /classes/Users.php to authenticated administrative sessions and trusted source networks.
Deploy a web application firewall rule that blocks SQL metacharacters in the ID parameter until code-level fixes are applied.
Audit the users and related tables for unauthorized modifications since the application was first exposed.

Patch Information

No official vendor patch has been published in the referenced advisories. Operators should track the SourceCodester Blog Post and VulDB Vulnerability Information for updates. In the interim, modify the delete handler in classes/Users.php to use prepared statements with bound parameters and to cast ID to an integer before query construction.

Workarounds

Rewrite the affected query using PDO or mysqli prepared statements with bound parameters for the ID value.
Apply server-side input validation that enforces a numeric type on the ID parameter before it reaches any SQL context.
Place the application behind an authenticated reverse proxy if administrative endpoints must remain reachable.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /classes/Users.php" \
  "chain,phase:2,deny,status:403,id:1026184,msg:'CVE-2026-10184 SQLi attempt'"
  SecRule ARGS:ID "@rx (?i)(\bunion\b|\bselect\b|--|';|\bor\b\s+1=1)" "t:none"