CVE-2026-8785: Hospital Management System SQLi Vulnerability

CVE-2026-8785 Overview

CVE-2026-8785 is a SQL injection vulnerability in Projectworlds Hospital Management System in PHP version 1.0. The flaw resides in the getAllPatientDetail function within update_info.php, where the appointment_no GET parameter is passed to a SQL query without proper sanitization. Remote attackers can manipulate this parameter to inject arbitrary SQL statements against the backend database. The exploit has been published, and the project maintainers have not responded to the issue report. The weakness is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote attackers can execute arbitrary SQL queries against the hospital management database without authentication, exposing patient records and enabling data manipulation.

Affected Products

Projectworlds Hospital Management System in PHP 1.0
Component: update_info.php GET parameter handler
Vulnerable function: getAllPatientDetail

Discovery Timeline

2026-05-18 - CVE-2026-8785 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-8785

Vulnerability Analysis

The vulnerability stems from unsafe handling of user-controlled input in the getAllPatientDetail function inside update_info.php. The appointment_no GET parameter is concatenated directly into a SQL query string without parameterization or input validation. Attackers can supply crafted values that alter the query's logical structure. This allows extraction of arbitrary database contents, modification of patient records, and potentially authentication bypass through UNION-based or boolean-based injection techniques. The exploit is publicly available, increasing the likelihood of opportunistic scanning and abuse against exposed instances.

Root Cause

The root cause is the absence of prepared statements or parameterized queries when constructing SQL using the appointment_no request parameter. PHP code in update_info.php interpolates the raw GET value into a query string, violating secure coding guidance for [CWE-74]. No server-side filtering, type coercion, or escaping is applied before the query reaches the MySQL backend.

Attack Vector

Exploitation requires only network access to the vulnerable web application. No authentication or user interaction is needed. An attacker sends an HTTP GET request to update_info.php with a malicious payload in the appointment_no parameter. Typical payloads include classic tautologies, UNION SELECT statements to enumerate tables, or time-based blind injection to exfiltrate data when responses are not directly reflected. Refer to the VulDB entry #364409 and the GitHub issue tracker for additional technical context.

Detection Methods for CVE-2026-8785

Indicators of Compromise

HTTP GET requests targeting update_info.php containing SQL metacharacters such as single quotes, --, UNION, SELECT, or SLEEP in the appointment_no parameter.
Unexpected database errors or unusually long response times tied to requests against update_info.php.
Web server access logs showing repeated probing of appointment_no with encoded payloads (e.g., %27, %20OR%201%3D1).

Detection Strategies

Deploy a web application firewall (WAF) rule set that flags SQL injection patterns specifically on the appointment_no query parameter.
Enable MySQL general query logging or audit logging to identify malformed queries originating from the hospital management application.
Correlate web access logs with database query logs to surface injection attempts that produce abnormal result sets.

Monitoring Recommendations

Monitor for spikes in 500-series HTTP responses returned by update_info.php.
Alert on outbound database queries that include statement-chaining (;), comment delimiters (--, /*), or INFORMATION_SCHEMA references.
Track authentication and patient record table access patterns for anomalous read volumes.

How to Mitigate CVE-2026-8785

Immediate Actions Required

Restrict network exposure of the Hospital Management System to trusted segments until a patch is available.
Apply WAF signatures to block SQL injection patterns on requests to update_info.php.
Audit the database for unauthorized reads, modifications, or new accounts created since deployment.

Patch Information

No vendor patch is available. The maintainers of Projectworlds Hospital Management System in PHP were notified through the GitHub issue tracker but have not responded. Organizations running this software should treat it as unmaintained and plan migration to a supported platform.

Workarounds

Rewrite the getAllPatientDetail function to use PDO prepared statements or mysqli_prepare with bound parameters for appointment_no.
Enforce strict server-side input validation to accept only numeric values for appointment_no.
Restrict the database account used by the application to least-privilege permissions, removing rights to system tables and write access where not required.
Remove or disable the update_info.php endpoint if it is not essential to operations.

bash

# Example: restrict access to update_info.php via Apache configuration
<Files "update_info.php">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Files>