SQL Injection Vulnerability in Projectworlds Hospital Management System by Projectworlds
CVE-2021-43630

8.8HIGH

Key Information:

Vendor

Projectworlds

Status
Hospital Management System In PHP
Vendor
CVE Published:
22 December 2021

What is CVE-2021-43630?

The Projectworlds Hospital Management System v1.0 contains a vulnerability allowing SQL injection through multiple user-supplied parameters in the add_patient.php script. This security flaw enables an authenticated attacker to manipulate queries sent to the database, potentially compromising sensitive data or executing unauthorized commands on the server. If exploited, this could lead to severe consequences, including the possibility of remote code execution, jeopardizing the integrity and confidentiality of the hospital's data.

References

https://projectworlds.in/free-projects/php-projects/hospi...
x_refsource_MISC
https://github.com/projectworldsofficial/hospital-managem...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.