CVE-2024-46532

CriticalCVSS 9.8

Published: 11/10/2024(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.94%

57th percentile - higher than 57% of all known CVEs

Summary

SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in the PayController.class.php component.

Risk Assessment

An attacker can gain unauthorized access to the database, steal or modify sensitive data, and potentially take control of the system.

Recommendation

Immediately update OpenHIS to the latest version and implement parameterized SQL queries in the refund function.

Original NVD description (English source)

SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in the PayController.class.php component.