A weakness has been identified in itsourcecode Hospital Management System 1

CVE-2026-13532 is a classic SQL injection in /departmentDoctor.php of itsourcecode Hospital Management System 1.0. The deptid argument is concatenated into a query unchecked, so an authenticated user with access to the department-doctor view can manipulate the query, dump tables, or escalate to deeper data exfil. Only version 1.0 is named — there is no maintained release stream and no vendor patch process; itsourcecode is a *code-snippet marketplace*, not a software vendor.

The vendor CVSS of 6.3 MEDIUM is technically defensible on paper (network attack vector, low privileges, low impact across CIA), but it materially overstates real-world risk. The affected codebase ships as a tutorial download — it is not deployed in any serious clinical environment, it has no patch pipeline, and the auth boundary already requires a valid login. For an enterprise patch queue managing real hospital infrastructure (Epic, Cerner/Oracle Health, Meditech), this CVE is noise.

Why this verdict

• Installed base ≈ 0 in enterprise: itsourcecode is a code-marketplace; this codebase is not procured, contracted, or supported in any real hospital environment.
• Authentication required: PR:L means the attacker already needs a valid session — no opportunistic drive-by mass-exploit scenario.
• Role multiplier — none: This component is not in the high-value role catalog. It is not an IdP, not a hypervisor, not a CA, not a backup server. The blast radius is bounded to the single app DB.
• No vendor patch pipeline: there is nothing to deploy; remediation is *replace the app or remove it from the network*.
• No KEV, no in-the-wild reports, no campaigns — and unlikely to ever appear given footprint.

Why not higher?

Not MEDIUM because authentication is required AND the affected component has essentially zero enterprise footprint. The vendor 6.3 score reflects the abstract CIA impact on the app's own DB but ignores that no production environment depends on this codebase. There is no role-multiplier path to elevate the floor.

Why not lower?

Not IGNORE because a public PoC exists, the bug is real, and any organization that *does* run this code (small clinic, student project, freelance dev) faces a trivial SQLi. If your asset inventory finds one, treat it; just do not let it crowd out real work.

1. Inventory for any itsourcecode artifacts — Grep web roots, package manifests, and CMDB for departmentDoctor.php and itsourcecode signatures. If you find none, you are done — document and move on. No mitigation SLA applies for LOW; complete inventory as backlog hygiene.
2. Remove or quarantine any instance found — Because there is no upstream patch, the only viable mitigation is to take the app offline or restrict to a single trusted IP. Treat any discovered instance as shadow IT; remediate within the noisgate 365-day window.
3. Block via WAF if removal is not immediate — Enable OWASP CRS rules 942100–942999 (SQLi family) on the upstream reverse proxy / Cloudflare / AWS WAF. Add a virtual-patch rule rejecting non-numeric deptid values.
4. Rotate any credentials stored in the app DB — If the instance was internet-facing at any point with default creds, assume the user table is compromised. Rotate and notify.

Run on any Linux web host suspected of hosting itsourcecode HMS. Invoke as sudo ./check_cve_2026_13532.sh /var/www against your web root. Requires read access to the web root (root or web-server user).

#!/usr/bin/env bash
# check_cve_2026_13532.sh - detect itsourcecode Hospital Management System 1.0
# Usage: sudo ./check_cve_2026_13532.sh <webroot>
# Exit codes: 0=PATCHED/not present, 1=VULNERABLE, 2=UNKNOWN
set -u
WEBROOT="${1:-/var/www}"

if [ ! -d "$WEBROOT" ]; then
  echo "UNKNOWN: webroot $WEBROOT not found"
  exit 2
fi

# Look for the canonical vulnerable file
HITS=$(find "$WEBROOT" -type f -name 'departmentDoctor.php' 2>/dev/null)
if [ -z "$HITS" ]; then
  echo "PATCHED: no itsourcecode HMS departmentDoctor.php present under $WEBROOT"
  exit 0
fi

VULN=0
for f in $HITS; do
  # Heuristic: unsanitized concatenation of deptid into a SQL string
  if grep -E -q "(SELECT|FROM|WHERE).*\\\$_(GET|REQUEST|POST)\[['\"]deptid" "$f" \
     || grep -E -q "deptid\s*=\s*['\"]?\s*\\\$_(GET|REQUEST|POST)" "$f"; then
    echo "VULNERABLE: $f references deptid via unsanitized superglobal"
    VULN=1
  fi
done

if [ "$VULN" -eq 1 ]; then
  exit 1
fi

echo "UNKNOWN: departmentDoctor.php present but no obvious sink match — manual review required"
exit 2

Sources

1. Vulnerability-Lookup (circl.lu) — CVE-2026-13532
2. VulDB 374540 entry
3. Public PoC — Fomovet/cve issue #3
4. Related: CVE-2026-13531 SQLi (OffSeq Radar)
5. Related: CVE-2026-13530 SQLi (OffSeq Radar)
6. Related: CVE-2026-13520 SQLi (OffSeq Radar)
7. Renrao bug_report — itsourcecode HMS SQLi notes
8. itsourcecode product page