CVE-2026-9356: Hospital Patient Records System SQLi Flaw

CVE-2026-9356 Overview

CVE-2026-9356 is a SQL injection vulnerability in SourceCodester Hospitals Patient Records Management System 1.0. The flaw resides in the /admin/patients/manage_history.php script, where the ID parameter is passed to a database query without proper sanitization. Remote attackers can manipulate the parameter to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the risk of opportunistic attacks against exposed installations.

Critical Impact

Remote, unauthenticated attackers can inject SQL through the ID parameter of manage_history.php, enabling unauthorized read or modification of patient health records stored in the backend database.

Affected Products

• SourceCodester Hospitals Patient Records Management System 1.0
• Affected file: /admin/patients/manage_history.php
• Vulnerable parameter: ID

Discovery Timeline

• 2026-05-24 - CVE-2026-9356 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9356

Vulnerability Analysis

The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected component, manage_history.php, accepts an ID value over HTTP and concatenates it into a SQL query string. Because the application does not use parameterized queries or input validation, attacker-supplied SQL syntax is interpreted by the database engine.

Successful exploitation grants the attacker the same database privileges as the application's database user. In a hospital records system, this database typically contains protected health information, administrative credentials, and audit logs. The EPSS score is 0.03% with a percentile of 9.148, but public disclosure of working exploit techniques raises practical risk for exposed deployments.

Root Cause

The root cause is missing input sanitization on the ID request parameter within manage_history.php. The application builds SQL statements through direct string concatenation rather than prepared statements with bound parameters. Any client able to reach the /admin/patients/ path can submit crafted values.

Attack Vector

The attack is delivered over the network with no authentication and no user interaction required. An attacker sends a single HTTP request to /admin/patients/manage_history.php with a tampered ID value containing SQL metacharacters. Refer to the GitHub Issue Report and VulDB Vulnerability #365319 for technical proof-of-concept details.

Detection Methods for CVE-2026-9356

Indicators of Compromise

• HTTP requests to /admin/patients/manage_history.php containing SQL metacharacters such as ', ", --, UNION, SELECT, SLEEP(, or OR 1=1 in the ID parameter.
• Web server access logs showing repeated requests to manage_history.php with abnormally long or URL-encoded ID values.
• Database error messages or HTTP 500 responses correlated with malformed ID values, indicating injection probing.

Detection Strategies

• Inspect web server and PHP error logs for syntax errors originating from manage_history.php query execution.
• Deploy web application firewall (WAF) signatures targeting common SQL injection payloads against the ID parameter.
• Enable database query auditing to capture queries referencing patient history tables that contain unexpected operators or stacked statements.

Monitoring Recommendations

• Alert on unauthenticated access patterns to /admin/ paths, which should normally require an authenticated session.
• Monitor for spikes in outbound data volume from the application database server, which may indicate bulk record exfiltration.
• Track database user activity for unusual INFORMATION_SCHEMA queries originating from the web application account.

How to Mitigate CVE-2026-9356

Immediate Actions Required

• Restrict network access to the /admin/ directory using IP allowlisting or VPN-only access until a patched build is available.
• Place a WAF in front of the application with rules blocking SQL injection payloads targeting manage_history.php.
• Audit the database account used by the application and remove privileges beyond those required for normal operation.

Patch Information

No official vendor patch has been published for SourceCodester Hospitals Patient Records Management System 1.0 at the time of NVD publication. Operators should consult the SourceCodester Resource for any future updates and review the VulDB Submission #813022 for vulnerability tracking.

Workarounds

• Modify manage_history.php to use PDO or mysqli prepared statements with bound parameters for the ID value.
• Cast the ID parameter to an integer using intval() before it reaches any SQL query, since patient record identifiers are numeric.
• Disable or remove the manage_history.php endpoint if patient history management is not actively used in your deployment.

# Configuration example: example nginx rule to block obvious SQLi patterns on the vulnerable endpoint
location = /admin/patients/manage_history.php {
    if ($args ~* "(union|select|sleep\(|or\s+1=1|--|;)") {
        return 403;
    }
    # Optional: restrict to internal admin network
    allow 10.0.0.0/8;
    deny all;
}