CVE-2023-4442
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A critical SQL injection vulnerability was found in Free Hospital Management System for Small Practices 1.0 in the file booking-complete.php. An attacker can remotely manipulate the userid, apponum, or scheduleid parameters, leading to SQL injection.
Risk Assessment
Successful exploitation could allow an attacker unauthorized access to the database, theft or modification of sensitive patient and medical staff data.
Recommendation
Immediately update the system to the latest version or apply a security patch. Until then, restrict access to booking-complete.php and validate all input parameters.
Original NVD description (English source)
A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. It has been rated as critical. This issue affects some unknown processing of the file \vm\patient\booking-complete.php. The manipulation of the argument userid/apponum/scheduleid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-237563.