CVE-2026-13532 · itsourcecode Hospital Management System 1.0 — SQL Injection in…

01 · The Real Story

A learner-grade PHP app with a leaky `deptid` parameter — interesting to bug bounty hunters, irrelevant to enterprise fleets

CVE-2026-13532 is a classic SQL injection in /departmentDoctor.php of itsourcecode Hospital Management System 1.0. The deptid argument is concatenated into a query unchecked, so an authenticated user with access to the department-doctor view can manipulate the query, dump tables, or escalate to deeper data exfil. Only version 1.0 is named — there is no maintained release stream and no vendor patch process; itsourcecode is a *code-snippet marketplace*, not a software vendor.

The vendor CVSS of 6.3 MEDIUM is technically defensible on paper (network attack vector, low privileges, low impact across CIA), but it materially overstates real-world risk. The affected codebase ships as a tutorial download — it is not deployed in any serious clinical environment, it has no patch pipeline, and the auth boundary already requires a valid login. For an enterprise patch queue managing real hospital infrastructure (Epic, Cerner/Oracle Health, Meditech), this CVE is noise.

"Authenticated SQLi in a hobby-grade PHP project with effectively zero enterprise install base. Vendor 6.3 overstates real risk."

02 · The Attack Path

4 steps from start to impact.

STEP 01

Discover an exposed instance

Attacker fingerprints a public itsourcecode HMS install via Shodan/FOFA favicon hashes or the distinctive /departmentDoctor.php route. The codebase is shipped as a downloadable demo so installs are rare and almost always lab / student / freelancer demos.

Conditions required:

Reachable HTTP(S) endpoint
Application deployed unmodified

Where this breaks in practice:

No enterprise procurement pipeline ships this code
Shodan returns a tiny population of obvious lab boxes

Detection/coverage: Generic web-app fingerprinting; no signature in commercial scanners specific to this product

STEP 02

Obtain low-privilege credentials

The vector is PR:L — attacker must authenticate. Default tutorial creds (admin/admin) are widely documented in the project's README. In real but rare deployments, weak or default creds are the norm because the operator is typically a student.

Conditions required:

Valid account on the application
Or default credentials still in place

Where this breaks in practice:

Any operator who changed the default password breaks this step
No SSO / federation in scope

Detection/coverage: Failed-login telemetry from the host web server, if logged at all

STEP 03

Inject into deptid via sqlmap

Authenticated user issues a request like GET /departmentDoctor.php?deptid=1' UNION SELECT ... or runs sqlmap -u '.../departmentDoctor.php?deptid=1' --cookie=PHPSESSID=.... Public PoC at github.com/Fomovet/cve/issues/3 confirms the parameter is directly concatenated.

Conditions required:

Authenticated session cookie
HTTP reach to the vulnerable endpoint

Where this breaks in practice:

A WAF with a generic OWASP CRS ruleset blocks the trivial payloads
MySQL user privileges typically scoped to one DB on shared LAMP hosting

Detection/coverage: sqlmap UA strings, error-based SQLi signatures in any modern WAF (Cloudflare, AWS WAF, ModSecurity CRS)

STEP 04

Dump patient and credential tables

Attacker enumerates information_schema.tables, extracts the users table for password hashes, and exfiltrates whatever clinical-themed mock data the install has. Because this is demo code, the data is usually fake — there is no real PHI.

Conditions required:

Successful SQLi in step 3
DB user with read access beyond the current view

Where this breaks in practice:

Real PHI never lives in this app
Hashes are typically MD5 — easy to crack but pointless if data is fake

Detection/coverage: Egress volume anomalies; DLP would not flag mock data

03 · Compensating Control

Inventory for any itsourcecode artifacts — Grep web roots, package manifests, and CMDB for departmentDoctor.php and itsourcecode signatures. If you find none, you are done — document and move on. No mitigation SLA applies for LOW; complete inventory as backlog hygiene.

Remove or quarantine any instance found — Because there is no upstream patch, the only viable mitigation is to take the app offline or restrict to a single trusted IP. Treat any discovered instance as shadow IT; remediate within the noisgate 365-day window.

Block via WAF if removal is not immediate — Enable OWASP CRS rules 942100–942999 (SQLi family) on the upstream reverse proxy / Cloudflare / AWS WAF. Add a virtual-patch rule rejecting non-numeric deptid values.

Rotate any credentials stored in the app DB — If the instance was internet-facing at any point with default creds, assume the user table is compromised. Rotate and notify.

What doesn't work

EDR on the web server — SQLi happens in-band in a legitimate PHP process; no malicious binary executes.
Network segmentation alone — if an authenticated user is the threat model, lateral controls don't help.
MFA on the app login — the project does not support MFA; bolting it on is more work than removing the app.
Waiting for a vendor patch — there is no maintained upstream; no patch is coming.

04 · Intelligence Metadata

The supporting signals.

In-the-wild exploitation	None observed. No GreyNoise tag, no CISA KEV listing, no incident reports.
Public PoC	Yes — Fomovet/cve#3; trivial `sqlmap` one-liner.
EPSS	Not yet scored at disclosure; comparable itsourcecode SQLi CVEs typically land <0.5% percentile (bottom decile).
KEV status	Not listed. Extremely unlikely to ever be added — no enterprise footprint.
CVSS 3.1	`AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L` → 6.3 MEDIUM (vendor). Authenticated, low-impact triad.
Affected versions	itsourcecode Hospital Management System 1.0 (only release).
Fixed version	None. No maintained release stream; project is a tutorial code drop.
Exposure data	Shodan / Censys / FOFA show negligible counts for distinctive HMS routes — overwhelmingly student / lab boxes.
Disclosure	2026-06-29 via VulDB; reporter Fomovet (VulDB user).
References	VulDB 374540, circl.lu lookup

Sources.

05 · The Call

Final Verdict

↓ DOWNGRADED to LOW (3.5/10)

Why this verdict

Installed base ≈ 0 in enterprise: itsourcecode is a code-marketplace; this codebase is not procured, contracted, or supported in any real hospital environment.
Authentication required: PR:L means the attacker already needs a valid session — no opportunistic drive-by mass-exploit scenario.
Role multiplier — none: This component is not in the high-value role catalog. It is not an IdP, not a hypervisor, not a CA, not a backup server. The blast radius is bounded to the single app DB.
No vendor patch pipeline: there is nothing to deploy; remediation is *replace the app or remove it from the network*.
No KEV, no in-the-wild reports, no campaigns — and unlikely to ever appear given footprint.

Why not higher?

Not MEDIUM because authentication is required AND the affected component has essentially zero enterprise footprint. The vendor 6.3 score reflects the abstract CIA impact on the app's own DB but ignores that no production environment depends on this codebase. There is no role-multiplier path to elevate the floor.

Why not lower?

Not IGNORE because a public PoC exists, the bug is real, and any organization that *does* run this code (small clinic, student project, freelance dev) faces a trivial SQLi. If your asset inventory finds one, treat it; just do not let it crowd out real work.

06 · Verification

Crowdsourced verification payload.

Run on any Linux web host suspected of hosting itsourcecode HMS. Invoke as sudo ./check_cve_2026_13532.sh /var/www against your web root. Requires read access to the web root (root or web-server user).

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# check_cve_2026_13532.sh - detect itsourcecode Hospital Management System 1.0
# Usage: sudo ./check_cve_2026_13532.sh <webroot>
# Exit codes: 0=PATCHED/not present, 1=VULNERABLE, 2=UNKNOWN
set -u
WEBROOT="${1:-/var/www}"

if [ ! -d "$WEBROOT" ]; then
  echo "UNKNOWN: webroot $WEBROOT not found"
  exit 2
fi

# Look for the canonical vulnerable file
HITS=$(find "$WEBROOT" -type f -name 'departmentDoctor.php' 2>/dev/null)
if [ -z "$HITS" ]; then
  echo "PATCHED: no itsourcecode HMS departmentDoctor.php present under $WEBROOT"
  exit 0
fi

VULN=0
for f in $HITS; do
  # Heuristic: unsanitized concatenation of deptid into a SQL string
  if grep -E -q "(SELECT|FROM|WHERE).*\\\$_(GET|REQUEST|POST)\[['\"]deptid" "$f" \
     || grep -E -q "deptid\s*=\s*['\"]?\s*\\\$_(GET|REQUEST|POST)" "$f"; then
    echo "VULNERABLE: $f references deptid via unsanitized superglobal"
    VULN=1
  fi
done

if [ "$VULN" -eq 1 ]; then
  exit 1
fi

echo "UNKNOWN: departmentDoctor.php present but no obvious sink match — manual review required"
exit 2