CVE-2026-10186 Details

A SQL injection vulnerability has been identified in the Online Hospital Management System version 1.0. The issue resides in the patient.php file, where the editid parameter is manipulated, allowing for SQL injection. This vulnerability can be exploited remotely by unauthenticated users, as the file does not implement any authentication checks before processing the editid parameter. Exploitation of this vulnerability could lead to unauthorized access and manipulation of patient records, bypassing authentication, or extraction of sensitive database information, including admin credentials.

To address this vulnerability, use prepared statements for all SQL queries that involve user input, add authentication and authorization checks before performing sensitive operations, validate resource ownership, change HTTP methods for state-changing operations to POST, and disable detailed error reporting in production environments.