SourceCodester Free Hospital Management System for Small Practices edit-user.php sql injection

CVE-2023-4444

What is CVE-2023-4444?

A SQL injection vulnerability exists in the Free Hospital Management System for Small Practices due to improper input validation in the file responsible for user data editing. This flaw enables attackers to manipulate user-provided parameters, such as id00, nic, oldemail, email, and Tele, to execute arbitrary SQL commands on the database. The vulnerability can be exploited remotely, exposing sensitive data and allowing unauthorized access to the database. Prompt updates and security measures are essential to mitigate any risks associated with this exposure.

References