CVE-2026-11501: Patient Records Management System SQLi

CVE-2026-11501 Overview

CVE-2026-11501 is a SQL injection vulnerability in SourceCodester Hospitals Patient Records Management System 1.0. The flaw resides in the /classes/Master.php?f=save_patient endpoint, where the ID parameter is passed into a database query without proper sanitization. Attackers can manipulate this parameter remotely to inject arbitrary SQL statements. The exploit has been disclosed publicly, increasing the likelihood of opportunistic attacks against exposed installations. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Remote, unauthenticated attackers can inject SQL into the save_patient handler to read, modify, or destroy patient records stored in the application database.

Affected Products

• SourceCodester Hospitals Patient Records Management System 1.0
• Component: /classes/Master.php (function save_patient)
• Vulnerable parameter: ID

Discovery Timeline

• 2026-06-08 - CVE-2026-11501 published to NVD
• 2026-06-08 - Last updated in NVD database
• 2026-06-11 - EPSS score published at 0.033% (percentile 10.252)

Technical Details for CVE-2026-11501

Vulnerability Analysis

The vulnerability exists in the patient save workflow exposed through /classes/Master.php?f=save_patient. The handler accepts an ID argument supplied by the HTTP request and embeds it directly into a SQL statement. Because the application does not use parameterized queries or escape the input, an attacker controls part of the query syntax. This allows query manipulation through standard SQL injection techniques such as boolean-based, error-based, time-based, or UNION-based payloads.

The endpoint is reachable over the network and does not require authentication, so adversaries can probe and exploit the flaw without prior access. Successful exploitation grants the attacker the same database privileges held by the web application user. In typical SourceCodester deployments, that account has full read and write access to the application schema, including patient identifiers, contact data, and clinical fields.

Root Cause

The root cause is improper neutralization of user-supplied input before it is concatenated into a SQL query [CWE-74]. The save_patient action treats the ID parameter as a trusted numeric value and does not bind it as a query parameter. Standard remediations such as prepared statements, type casting, or input allowlisting are absent.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a crafted HTTP POST or GET request to /classes/Master.php?f=save_patient with a malicious ID value. The exploit code is publicly available, and exploitation requires no user interaction. Attackers can extract data using UNION-based payloads, enumerate the schema through error messages, or trigger conditional delays to perform blind extraction. For technical details, see the VulDB Vulnerability Details and the GitHub Issue Report.

Detection Methods for CVE-2026-11501

Indicators of Compromise

• HTTP requests to /classes/Master.php?f=save_patient containing SQL meta-characters such as single quotes, UNION SELECT, SLEEP(, --, or /* in the ID parameter.
• Web server access logs showing repeated requests to the save_patient endpoint from a single source with varying ID payloads.
• Database error messages referencing Master.php in application or PHP error logs.
• Unexpected outbound database queries that return large result sets or include system tables such as information_schema.

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect the ID parameter for SQL injection signatures on the save_patient route.
• Enable database query logging and alert on queries originating from the application user that reference information_schema, mysql.user, or use UNION operators.
• Correlate web access logs with database audit logs to identify request-to-query patterns that indicate injection.

Monitoring Recommendations

• Monitor for anomalous spikes in 500-series HTTP responses from the Master.php endpoint, which often accompany error-based injection attempts.
• Track long-running database queries that may indicate time-based blind SQL injection.
• Alert on access to the application from IP addresses not associated with normal clinical workflows.

How to Mitigate CVE-2026-11501

Immediate Actions Required

• Restrict network access to the Hospitals Patient Records Management System so that only trusted clinical networks can reach the application.
• Place the application behind a WAF with SQL injection protection enabled for the /classes/Master.php path.
• Audit the database for unauthorized changes to patient records and review credential exposure in the application database.
• Rotate database credentials used by the application if compromise is suspected.

Patch Information

No official vendor patch is referenced in the public advisories. SourceCodester project pages and the GitHub Issue Report should be monitored for fixes. Until a patch is available, operators must apply code-level mitigations in /classes/Master.php by replacing string concatenation with prepared statements and binding the ID parameter as an integer.

Workarounds

• Modify Master.php to cast ID to an integer before use, for example $id = (int)$_POST['id'];, and rebuild the query with parameter binding through PDO or mysqli prepared statements.
• Apply a least-privilege database account that cannot read system catalogs or write outside the application schema.
• Disable verbose PHP and database error reporting in production to limit information leakage during exploitation attempts.
• Consider taking the application offline if it stores regulated patient data and cannot be patched promptly.