CVE-2026-111990: SQL Injection in Kishan0725 Hospital Management System

Overview

A SQL injection vulnerability has been disclosed in the kishan0725 Hospital Management System, a widely forked open-source PHP application used to run clinic and hospital administration portals. Tracked as CVE-2026-111990 with a CVSS 3.1 score of 7.3 (High), the flaw sits in the mysqli_query call inside admin-panel.php's Appointment Cancellation Handler, where the ID argument is passed into a SQL statement without sanitization.

The issue affects versions of the project up to commit 777fda46b77a820977a5ba616283dbfbc40bf7e1. A public exploit is already circulating, and the maintainer has not responded to the original issue report.

Technical Details

How It Works

The Appointment Cancellation Handler in admin-panel.php builds a SQL query against the ID parameter supplied when an administrator (or anyone able to reach the endpoint) cancels an appointment. The value is concatenated directly into the query string passed to mysqli_query rather than being bound as a parameter, so an attacker who can manipulate the ID argument can inject arbitrary SQL. Because the endpoint requires no authentication token validation beyond what the admin panel already exposes, and no user interaction beyond a single crafted request, the attack can be automated and run remotely.

Security researchers have noted this is one of several SQL injection issues disclosed in the same codebase recently — related reports affect get_doctor.php, view-patient.php, edit-patient.php, and search.php — suggesting the project's database access layer broadly lacks parameterized queries.

Impact Assessment

Who Is At Risk

Any clinic, small hospital, or health IT shop running an unmodified or lightly modified deployment of this project is exposed, particularly installations that:

• Expose the admin panel to the internet rather than restricting it to an internal network or VPN
• Have not audited third-party PHP forks of this project pulled from GitHub
• Store patient, appointment, or billing data in the same database the vulnerable query touches

Potential Attack Chains

1. Reconnaissance — Attacker identifies a live Hospital Management System instance (the project is popular as a student/portfolio template and is deployed as-is by small clinics)
2. Injection — Attacker sends a crafted ID value to the appointment cancellation endpoint in admin-panel.php
3. Data Exposure or Manipulation — Depending on the underlying query structure, the attacker can read, modify, or delete rows in the hospital's database — including patient records, appointment history, and potentially credentials stored in the same schema
4. Downstream Compromise — Database credentials or stored data recovered via the injection can be reused to pivot into other parts of the deployment

Given the confidentiality, integrity, and availability impact rated across the vector string, successful exploitation can expose protected health information (PHI) as well as corrupt scheduling data.

Mitigation

Immediate Actions

• Do not expose the admin panel (admin-panel.php and related admin routes) directly to the public internet; place it behind a VPN, IP allowlist, or reverse-proxy authentication layer
• Audit the Appointment Cancellation Handler and any other mysqli_query call sites in the codebase for string-concatenated SQL and convert them to prepared statements with bound parameters
• Review database logs for anomalous queries against the appointments table, especially unexpected UNION, OR 1=1, or stacked-query patterns
• Because the upstream vendor has not responded to the disclosure, treat this as an unpatched vulnerability — self-remediate at the code level rather than waiting for an official fix

Detection Opportunities

• Monitor web server access logs for requests to admin-panel.php with anomalous or malformed ID parameters
• Deploy a web application firewall (WAF) rule to block common SQL injection payloads on the admin panel's cancellation endpoint as a stopgap
• Enable verbose MySQL error logging temporarily to catch malformed queries reaching the database layer

Defence-in-Depth

• Run the application database user with least-privilege access — it should not be able to read or write tables outside what the admin panel legitimately needs
• Segment patient data stores from general application data where feasible, so a single injection point cannot reach the full database
• If this project is running as a long-term production system rather than a demo/student deployment, consider migrating to a maintained, actively-patched hospital management platform

Discovery & Disclosure

The vulnerability was reported upstream via GitHub issue #75 on the kishan0725/Hospital-Management-System repository. As of publication, the maintainer has not responded or shipped a fix, and CVE-2026-111990 is not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A public exploit is reported to already be in circulation, so defenders running this codebase should prioritize mitigation over waiting for upstream action.

References

• NVD — CVE-2026-111990
• Strix — CVE-2026-111990: Hospital Management System Injection
• VulDB — CVE-2026-111990