CVE-2026-5960: Patient Record Management System Flaw

CVE-2026-5960 Overview

A weakness has been identified in code-projects Patient Record Management System 1.0 that affects the SQL Database Backup File Handler component. The vulnerability exists in the file /db/hcpms.sql, where improper access controls allow remote attackers to access sensitive database backup information. This information disclosure vulnerability (CWE-200) enables attackers to retrieve potentially sensitive patient and system data through network-accessible database backup files.

Critical Impact

Remote attackers can access exposed SQL database backup files containing potentially sensitive healthcare information, patient records, and system configuration data without authentication.

Affected Products

• code-projects Patient Record Management System 1.0
• SQL Database Backup File Handler component (/db/hcpms.sql)

Discovery Timeline

• April 9, 2026 - CVE-2026-5960 published to NVD
• April 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-5960

Vulnerability Analysis

This vulnerability represents an information disclosure flaw classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The Patient Record Management System stores SQL database backup files in a web-accessible location without proper access controls. The vulnerable file /db/hcpms.sql can be directly accessed by remote attackers through standard HTTP requests.

Healthcare management systems commonly contain sensitive personally identifiable information (PII), protected health information (PHI), and system credentials. When database backup files are stored in publicly accessible directories without authentication requirements, attackers can download complete database dumps containing this sensitive data.

Root Cause

The root cause stems from insecure storage of database backup files within the web-accessible directory structure. The application fails to implement proper access controls on the /db/ directory, allowing direct file access. Additionally, the backup file uses a predictable naming convention (hcpms.sql), making it trivial for attackers to locate and retrieve.

Attack Vector

The attack can be launched remotely over the network with minimal complexity. An attacker requires no authentication or special privileges to exploit this vulnerability. The attack vector involves directly requesting the database backup file URL. User interaction is required, as the vulnerability requires the victim system to be accessible and the backup file to exist.

The exploitation process involves identifying a vulnerable Patient Record Management System installation, constructing a request to the known backup file path, and downloading the exposed SQL database backup containing potentially sensitive information including patient records, user credentials, and system configuration data.

Detection Methods for CVE-2026-5960

Indicators of Compromise

• HTTP access logs showing requests to /db/hcpms.sql or similar database backup file paths
• Unusual outbound data transfers from the web server hosting the application
• Requests from external IP addresses targeting the /db/ directory structure
• Web server logs indicating successful 200 responses for .sql file requests

Detection Strategies

• Monitor web server access logs for requests to database backup files (.sql, .bak, .dump extensions)
• Implement web application firewall (WAF) rules to block access to common backup file paths
• Configure intrusion detection systems to alert on access attempts to sensitive file extensions
• Review file system permissions and directory listings for the application's web root

Monitoring Recommendations

• Enable verbose logging on the web server to capture all file access requests
• Set up alerts for any successful access to files in the /db/ directory
• Implement file integrity monitoring on database backup files and directories
• Regularly audit web server configurations to ensure directory listing is disabled

How to Mitigate CVE-2026-5960

Immediate Actions Required

• Move database backup files outside of the web-accessible directory structure immediately
• Implement access controls to restrict access to the /db/ directory
• Review and rotate any credentials that may have been exposed in the backup file
• Audit access logs to determine if the vulnerability has already been exploited

Patch Information

No official vendor patch has been identified for this vulnerability. The application is developed by code-projects, and administrators should check the Code Projects Resource Hub for any updates. In the absence of an official patch, implement the workarounds below.

Additional technical details are available through the GitHub CVE Information Disclosure report and VulDB Vulnerability #356513.

Workarounds

• Relocate all database backup files to a directory outside the web root (e.g., /var/backups/)
• Configure web server to deny access to .sql files and the /db/ directory
• Implement .htaccess rules (Apache) or location blocks (Nginx) to restrict access
• Consider encrypting database backups at rest to protect data if files are inadvertently exposed

# Apache .htaccess configuration to block access to SQL files
<FilesMatch "\.(sql|bak|dump)$">
    Require all denied
</FilesMatch>

# Block access to /db/ directory
<Directory "/var/www/html/db">
    Require all denied
</Directory>