Unreported Vulnerabilities in Four PHP Hospital Management System Demos

Researcher: independent security research Date: 2026-06-29

The four products covered here are free PHP tutorial/demo apps. As far as we can tell none of them runs real infrastructure, so this is educational. The point is to give each author enough to fix the code (or label it as a teaching sample) without shipping working exploits. No PoCs below.

Background

All four apps already have CVEs for the same bug classes listed here, often in the same file or an adjacent copy of it. The items below are the ones nobody bothered to file. Where an existing CVE covers the same class, it's listed in the Precedent column so the author can see this isn't a judgment call.

The ~40 rows boil down to a few defects per app: queries built by string concatenation, output printed without escaping, auth checks that don't stop execution, no CSRF tokens, and in one case an upload with no validation. Fix the defect, not the 40 instances.

PHPGurukul Hospital Management System (v4.0/1.0)

Source root: hms/. Contact: author via phpgurukul.com.

# File:line CWE Class Sink / parameter Precedent CVE
PG-01admin/change-password.php:2089SQLinpass (2nd param in the same query)CVE-2024-0362 (cpass, same file)
PG-02reset-password.php:11, doctor/reset-password.php:1189SQLisession-stored name/emailCVE-2020-22166 (forgot-password.php)
PG-03doctor/forgot-password.php:9, doctor/index.php:989SQLicontactno/email, usernameCVE-2020-22165 (patient user-login.php)
PG-04appointment-history.php:10, doctor/appointment-history.php:1189/639SQLi + IDORid (GET), no ownership checkCVE-2020-22169 (same file, id)
PG-05admin/check_availability.php:6, doctor/check_availability.php:589SQLi (unauth)emailid/emailCVE-2020-22164 (root check_availability.php)
PG-06admin/contact.php:1789SQLipagetitle,pagedes,email (same query as the CVE'd mobnum)CVE-2024-0361 (admin/contact.php, mobnum)
PG-07doctor/edit-profile.php:1689SQLiprofile fieldsCVE-2020-22173 (edit-profile.php)
PG-08~10 admin/doctor listing pages (manage-patient.php, manage-doctors.php, user-logs.php, doctor-logs.php, read-query.php, unread-queries.php, manage-medhistory.php, view-medhistory.php)79Stored XSSecho $row[...] with no escapingCVE-2022-42206, CVE-2024-56990
PG-09every state-changing form352CSRFno tokenCVE-2025-70062 (Add Doctor)

itsourcecode Hospital Management System (1.0)

Source root: flat, root-level *.php. Contact: author via itsourcecode.com.

# File:line CWE Class Sink / parameter Precedent CVE
IT-01adminlogin.php:41, doctorlogin.php:16, patientlogin.php:1789/287SQLi auth bypassloginid/password in the login SELECTthe 14 issued itsourcecode SQLi CVEs (e.g. CVE-2026-13497)
IT-02treatmentrecord.php:7434Unrestricted upload (RCE)$_FILES[uploads] to move_uploaded_file, no checksnone — fix this one first
IT-03treatmentrecord.php:11,23,40,4789/352SQLi + state change over GETeditid/delid/patientid/appidCVE-2026-13530 (appointmentdetail.php, editid)
IT-04treatmentrecord.php:69,74,178, patientdetail.php:14479XSSGET/DB values echoed rawCVE-2026-11512 (billing.php)
IT-05patient.php:8, patientprofile.php:689SQLiadmissiontme + fields, editidCVE-2026-11514 (filed against a file that doesn't exist; this is the real location)
IT-06~46 more root files (full list in HMS_UNDISCLOSED_CVES.md)89SQLieditid/delid etc. concatenatedthe 14 issued SQLi CVEs

itsourcecode has no admin/ folder; admin pages sit at the root. CVE-2026-13495 (adminprofile.php) is a valid precedent. CVE-2026-11513 (adminaccount.php, "Date") points at a sink that isn't there.

SourceCodester Free Hospital Management System for Small Practices (1.0)

Codename Vaidya Mitra, app folder /vm/. Source root: vm/. Contact: author mayuri_k via SourceCodester.

# File:line CWE Class Sink / parameter Precedent CVE
SC-01admin/delete-doctor.php:1889/862SQLi + broken auth$_GET[id], guard has no exitCVE-2023-4181 (same file)
SC-02admin/add-new.php:5589SQLiemail/name/nic/Tele/specCVE-2023-4443 (doctor/edit-doc.php)
SC-03admin/edit-doc.php:4489SQLidoctor fields (admin copy)CVE-2023-4443 (doctor/edit-doc.php)
SC-04admin/add-session.php:2389SQLidocid/title/date/time/nopCVE-2023-4440 (appointment.php)
SC-05admin/delete-session.php:21, doctor/delete-session.php:2189/639SQLi + IDOR$_GET[id]CVE-2023-4181
SC-06admin/delete-appointment.php:21 (+ doctor, + patient)89/639SQLi + IDOR$_GET[id], wrong role check, no exitCVE-2024-11073 (patient/delete-account.php)
SC-07admin/appointment.php:292, doctor/appointment.php:28589SQLisheduledate/docidCVE-2023-4440/4441 (patient appointment.php)
SC-08admin/doctors.php, doctor/doctors.php (~:446/:688)89/79SQLi + XSS$_GET[id]/$_GET[name]; auth check commented outCVE-2023-5587 (admin/doctors.php, search)
SC-09doctor/settings.php:43179Stored XSSname/email into value='.$name.'CVE-2024-11102 (doctor/edit-doc.php)
SC-10doctor/appointment.php:5689SQLi (second order)$useremail from sessionCVE-2023-4180 (login.php)
SC-11GET-based deletes app-wide352CSRFno tokennone
SC-1227 protected pages (full list in HMS_UNDISCLOSED_CVES.md)862Broken access controlheader(location) with no exitCVE-2023-4181, CVE-2024-11073

code-projects.org Hospital Management System (1.0)

Author "Fabian Ros". Source root: hospital/hms/. Uses the old mysql_* API.

# File:line CWE Class Sink / parameter Precedent CVE
CP-01doctor/index.php:689/287SQLi auth bypassusername (docEmail=)CVE-2024-12969 (admin/index.php), CVE-2024-8569 (user-login.php)
CP-02registration.php:11 (+ admin/doctor copies)89SQLifull_name/address/city/gender/emailCVE-2024-10350 (admin/add-doctor.php)
CP-03book-appointment.php:2089SQLiappointment fieldsCVE-2024-8944 (check_availability.php)
CP-04edit-profile.php:1489SQLiprofile UPDATE fieldsCVE-2025-3206
CP-05admin/edit-doctor-specialization.php:1289SQLidoctorspecilization (edit page; CVE covers the add page)CVE-2025-3206 (admin/doctor-specilization.php)
CP-06admin/edit-doctor.php:1689SQLidocname/docfees etc. (edit; CVE covers add)CVE-2024-10350 (admin/add-doctor.php)
CP-07doctor/edit-profile.php:1489SQLidoctor profile UPDATECVE-2024-10350
CP-08get_doctor.php:2089SQLidoctor (second sink in the file)CVE-2024-10170 (get_doctor.php, specilizationid)
CP-09getfee.php:1089SQLi (unauth, unquoted)docinfoCVE-2024-8944
CP-10admin/doctor-specilization.php:15, manage-doctors.php:11, manage-users.php:1089/639SQLi + IDOR$_GET[id] DELETECVE-2025-3206, CVE-2024-12983
CP-11appointment-history.php:9, doctor/appointment-history.php:989/639SQLi + IDOR$_GET[id] status UPDATECVE-2024-10350
CP-12admin/change-password.php:11,1589SQLicpass/npass, not md5-wrappedCVE-2024-10169 (user change-password.php; that CVE isn't exploitable as filed, this one is)
CP-13manage-users.php:100, manage-doctors.php:97, doctor-specilization.php:139, appointment-history.php:9479Stored XSSecho $row[...] unescapedCVE-2024-12983 (admin/manage-doctors.php)
CP-14app-wide352CSRFno token, GET deletesnone
CP-15admin/index.php:7256Plaintext credentialsadmin password stored/compared as plaintextnone

Fixes

Same defects in every app, so the fixes are the same:

For demo projects the realistic fix is probably a "do not deploy, insecure by design" notice plus the changes above.

Notes

Full per-file lists are in HMS_UNDISCLOSED_CVES.md. A few existing CVEs look wrong and may be worth a correction request to the assigning CNA: CVE-2026-1550 points at a Django .py file, CVE-2025-11609 at a Node/express-session artifact, CVE-2026-11513 at a sink that isn't there (adminaccount.php takes no request input), CVE-2026-11514 at a file that isn't there (though its admissiontme SQLi is real and lives in patient.php:8 — a wrong-filename correction, not a withdrawal), CVE-2024-10169 isn't exploitable as written (its cpass is md5()-wrapped), and CVE-2023-4176 names a file that isn't in the codebase. Details in HMS_CVE_FARMING_AUDIT.md.

Timeline: findings compiled 2026-06-29. Vendor notification and public writeup TBD.


Updated 07/23/26 — Re-verified the flagged filings against source. CVE-2026-11514 clarified: it is a real admissiontme SQLi filed against a non-existent file (addpatient.php); the correct location is patient.php:8, so the appropriate action is a filename correction rather than a withdrawal. CVE-2026-11513 confirmed non-reproducible (adminaccount.php has no user input).