CVE-2026-11501: SQL Injection in SourceCodester Hospital Patient Records Management System

Technical summary

CVE-2026-11501 is a SQL injection flaw in the /classes/Master.php file, specifically in the save_patient request handler. The vulnerability stems from improper input validation on the ID parameter (CWE-89). The attack vector is network-based with no authentication or user interaction required, allowing an unauthenticated attacker to execute arbitrary SQL queries against the underlying database. The CVSS 3.1 score of 7.3 (HIGH) reflects confidentiality, integrity, and availability impacts. The related CWE-74 (Improper Neutralization of Special Elements in Output) suggests inadequate output encoding as a contributing factor.

Business impact

Healthcare organizations deploying this system face direct exposure of sensitive patient data, including personal health information (PHI), medical histories, and potentially financial details. Attackers can extract entire patient databases, modify treatment records creating patient safety risks, or delete records to disrupt operations. Given the public availability of exploit code and the system's role in patient care workflows, this represents an urgent business risk: compliance violations (HIPAA, GDPR), reputational damage, legal liability, and operational continuity threats.

Affected systems

SourceCodester Hospitals Patient Records Management System version 1.0 is confirmed vulnerable. Organizations using this system in production environments are directly impacted. No patched versions have been referenced in available advisories; verification with SourceCodester is essential to determine if updates exist.

Exploitability

Exploitability is high and practical. The vulnerability requires no authentication, no special privileges, and no user interaction—an attacker only needs network access to the web application. Public exploit code is in circulation, lowering the bar for attack execution. Healthcare networks are high-value targets, making active exploitation likely in the near term.

Remediation

Immediate action required: Contact SourceCodester to confirm the availability of patched versions and apply updates as soon as they become available. If patches are unavailable, implement compensating controls: isolate the application from untrusted networks, enforce strict firewall rules limiting access to authorized users only, and apply a Web Application Firewall (WAF) with SQL injection filtering rules. Database permissions should be reviewed to ensure the application account has minimal required privileges. Conduct a security audit of the system and review database logs for signs of prior exploitation.

Patch guidance

Check the SourceCodester website and contact their support team directly for patch availability and version upgrade instructions. Apply patches in a test environment first to validate compatibility with existing patient records. Document the patching process and maintain version control of the system configuration. If patches remain unavailable, escalate to senior IT leadership for risk acceptance or system replacement decisions.

Detection guidance

Monitor web server logs for unusual SQL syntax in the ID parameter (e.g., quotes, union statements, comment markers like -- or /*). Enable database query logging and alert on unexpected SELECT, INSERT, UPDATE, or DELETE statements from the application user account. Implement network-based intrusion detection rules targeting SQL injection payloads. Review database access logs for queries originating outside normal application workflows. Check for unusual data exports or large query result sets that may indicate data exfiltration.

Why prioritize this

This vulnerability merits critical/highest priority due to: (1) public exploit availability and active threat landscape; (2) direct access to sensitive healthcare data without authentication; (3) potential for data theft, modification, or destruction affecting patient safety and operations; (4) regulatory compliance exposure (HIPAA); (5) network-accessible attack surface requiring no special conditions. Remediation timelines should be measured in hours to days, not weeks.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) appropriately reflects the combination of network accessibility (AV:N), low complexity (AC:L), no privilege or user interaction requirements (PR:N/UI:N), and measurable impacts across confidentiality, integrity, and availability (C:L/I:L/A:L). The score does not account for public exploit availability or the sensitive nature of healthcare data, which elevates real-world risk beyond the numeric score; security teams should treat this as critical given the operational context.

Frequently asked questions