CVE-2026-9342: Hospital Patient Records System SQLi Flaw

CVE-2026-9342 Overview

CVE-2026-9342 is a SQL injection vulnerability in SourceCodester Hospitals Patient Records Management System 1.0. The flaw resides in the /admin/patients/view_history.php script, where the ID parameter is passed to a database query without proper sanitization. Authenticated remote attackers can manipulate this parameter to inject arbitrary SQL statements. The exploit has been disclosed publicly, increasing the risk of opportunistic attacks against exposed installations. The weakness is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Authenticated attackers can extract, modify, or delete patient records stored in the application database by injecting SQL through the ID parameter.

Affected Products

• SourceCodester Hospitals Patient Records Management System 1.0
• Component: /admin/patients/view_history.php
• Vulnerable parameter: ID

Discovery Timeline

• 2026-05-23 - CVE-2026-9342 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9342

Vulnerability Analysis

The vulnerability exists in the administrative patient history view of the Hospitals Patient Records Management System. When a user requests /admin/patients/view_history.php, the application reads the ID query parameter and concatenates it directly into a SQL statement. Because the value is not parameterized or sanitized, an attacker can break out of the intended query context and append additional SQL clauses. The attack requires network access to the admin interface and low-privilege authentication, as reflected by the CVSS vector component PR:L. Successful exploitation impacts confidentiality, integrity, and availability of records stored in the backend database.

Root Cause

The root cause is direct interpolation of untrusted user input into a SQL query. The view_history.php script does not use prepared statements or apply input validation to the ID parameter. This is a classic injection pattern in PHP applications that rely on string concatenation with mysqli_query or similar APIs instead of parameter binding.

Attack Vector

An authenticated attacker sends a crafted HTTP GET request to /admin/patients/view_history.php?ID=<payload>. Typical payloads include UNION SELECT statements to exfiltrate data from other tables, boolean-based blind injections to enumerate schema, or time-based payloads using SLEEP() when output is suppressed. Because patient management systems store protected health information, successful injection enables disclosure of sensitive medical data and modification of audit records.

No verified proof-of-concept code is available in this advisory. See the GitHub Issue Report and VulDB Vulnerability #365305 for additional technical context.

Detection Methods for CVE-2026-9342

Indicators of Compromise

• HTTP requests to /admin/patients/view_history.php containing SQL keywords such as UNION, SELECT, SLEEP, --, or /* in the ID parameter.
• Web server access logs showing abnormally long ID parameter values or non-numeric values where an integer is expected.
• Database error messages referencing syntax errors logged near requests to view_history.php.

Detection Strategies

• Deploy web application firewall (WAF) rules that flag SQL metacharacters in numeric parameters bound to view_history.php.
• Enable verbose database query logging and alert on queries originating from the patient history endpoint that contain UNION or stacked statements.
• Correlate admin authentication events with subsequent anomalous query patterns to identify abuse of low-privilege accounts.

Monitoring Recommendations

• Monitor outbound responses for sudden increases in row counts returned by view_history.php, which may indicate data exfiltration.
• Track failed login attempts against the admin interface to detect credential stuffing that precedes exploitation.
• Review database audit logs daily for schema enumeration queries against information_schema.

How to Mitigate CVE-2026-9342

Immediate Actions Required

• Restrict access to the /admin/ directory to trusted IP ranges using web server ACLs until a patch is applied.
• Rotate credentials for all administrative accounts on the application to limit abuse of the low-privilege precondition.
• Audit existing patient and audit tables for unauthorized modifications or unexpected new rows.

Patch Information

No official vendor patch has been published by SourceCodester at the time of writing. Refer to SourceCodester Security Resources for vendor updates and to VulDB Vulnerability #365305 for tracking remediation status.

Workarounds

• Modify view_history.php to cast the ID parameter to an integer using intval() before use in the query.
• Replace string-concatenated queries with prepared statements using mysqli_prepare and bound parameters.
• Deploy a WAF rule that blocks requests where the ID parameter contains non-numeric characters.

# Example WAF rule (ModSecurity) to block non-numeric ID values
SecRule ARGS:ID "!@rx ^[0-9]+$" \
    "id:1009342,phase:2,deny,status:403,\
    msg:'CVE-2026-9342: Non-numeric ID parameter to view_history.php',\
    tag:'sqli',tag:'CVE-2026-9342'"