CVE-2026-10185: Hospital Records Management SQLi Flaw

CVE-2026-10185 Overview

CVE-2026-10185 is a SQL injection vulnerability in SourceCodester Hospitals Patient Records Management System 1.0. The flaw resides in the /classes/Users.php?f=save endpoint, where the ID parameter is concatenated into a database query without sanitization. Remote attackers can exploit the issue over the network without authentication or user interaction. Public exploit details have been disclosed, lowering the barrier for opportunistic abuse. The weakness is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Unauthenticated remote attackers can manipulate the ID parameter to inject arbitrary SQL, exposing patient records and enabling tampering with the underlying database.

Affected Products

• SourceCodester Hospitals Patient Records Management System 1.0
• Deployments using the bundled /classes/Users.php user-save handler
• Web applications derived from the same SourceCodester codebase

Discovery Timeline

• 2026-05-31 - CVE-2026-10185 published to NVD
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10185

Vulnerability Analysis

The vulnerability exists in the user management routine handled by /classes/Users.php?f=save. The application accepts the ID parameter from HTTP request data and embeds it directly into a SQL statement. Because no prepared statements or input validation are applied, attacker-controlled values are interpreted as SQL syntax rather than literal data.

The endpoint is reachable over the network and does not require authentication or user interaction. Successful exploitation lets an attacker read or modify records in the underlying MySQL database, including credentials stored in the users table. Public proof-of-concept details have been published in a third-party issue tracker, which makes weaponization straightforward for less skilled actors.

Root Cause

The root cause is improper neutralization of special elements in the ID parameter before it is passed to the SQL interpreter. The PHP handler relies on direct string interpolation rather than parameterized queries, allowing metacharacters such as single quotes, comments, and UNION clauses to break out of the intended query context.

Attack Vector

An attacker submits a crafted POST or GET request to /classes/Users.php?f=save with a tampered ID value. The injected payload can extract data using UNION SELECT, bypass authentication logic, or execute time-based blind queries. See the GitHub Issue Discussion and VulDB Vulnerability Details for technical artifacts associated with the disclosure.

Detection Methods for CVE-2026-10185

Indicators of Compromise

• Web server logs containing requests to /classes/Users.php?f=save with SQL metacharacters such as ', --, UNION, or SLEEP( in the ID parameter.
• Unexpected database errors or long response times tied to requests against the Users.php save handler.
• New or modified rows in the users table that were not initiated by an administrator action.

Detection Strategies

• Deploy web application firewall signatures that flag SQL syntax in the ID parameter of /classes/Users.php.
• Enable MySQL general or audit logging and alert on queries originating from the application that contain UNION, INFORMATION_SCHEMA, or stacked statements.
• Correlate authentication anomalies with concurrent requests to the affected endpoint to surface credential-theft attempts.

Monitoring Recommendations

• Forward web server, PHP-FPM, and database logs to a centralized analytics platform for retention and query.
• Track baseline request rates to /classes/Users.php and alert on volumetric spikes that may indicate automated injection tooling.
• Review outbound network connections from the application host for unexpected data egress following suspicious requests.

How to Mitigate CVE-2026-10185

Immediate Actions Required

• Restrict access to the application to trusted networks until a code fix is applied.
• Block requests containing SQL metacharacters in the ID parameter at the reverse proxy or WAF layer.
• Rotate database credentials and audit the users table for unauthorized accounts or privilege changes.

Patch Information

No official vendor patch is currently referenced in the advisory data. Operators should monitor the SourceCodester project page and the VulDB CVE-2026-10185 entry for fix availability. As an interim remediation, replace the vulnerable concatenated query in /classes/Users.php with a parameterized statement using PDO or mysqli prepared statements, and cast the ID value to an integer before use.

Workarounds

• Place the application behind a WAF rule that rejects non-numeric ID values to the Users.php?f=save endpoint.
• Apply least-privilege permissions to the database account used by the application so it cannot read sensitive tables or write outside its scope.
• Disable or remove the affected endpoint if the user-save functionality is not required in production.

# Example WAF rule (ModSecurity) to enforce numeric ID values
SecRule REQUEST_URI "@beginsWith /classes/Users.php" \
    "chain,phase:2,deny,status:400,id:1026010185,msg:'CVE-2026-10185 SQLi attempt'"
    SecRule ARGS:ID "!@rx ^[0-9]+$" "t:none"