itsourcecode Hospital Management System 1.0 — Authenticated Injection (CWE-74)

#!/usr/bin/env bash
# noisgate verifier: CVE-2026-13541 — itsourcecode HMS 1.0 injection (CWE-74)
# Usage: ./check-cve-2026-13541.sh <webroot>
set -u

WEBROOT="${1:-/var/www/html}"

if [ ! -d "$WEBROOT" ]; then
  echo "UNKNOWN: webroot $WEBROOT not found"
  exit 2
fi

# Fingerprint 1: project signature files
SIG_HITS=0
for needle in "Hospital Management System" "hms_db" "itsourcecode"; do
  if grep -r -l --include="*.php" --include="*.sql" -- "$needle" "$WEBROOT" >/dev/null 2>&1; then
    SIG_HITS=$((SIG_HITS+1))
  fi
done

if [ "$SIG_HITS" -eq 0 ]; then
  echo "PATCHED: no itsourcecode HMS artifacts found under $WEBROOT"
  exit 0
fi

# Fingerprint 2: known vulnerable pattern — unsanitized concatenation into mysqli_query
VULN_SINKS=$(grep -r -E "mysqli_query\s*\([^,]+,\s*[\"'][^\"']*\\\$_(GET|POST|REQUEST)" \
  --include="*.php" "$WEBROOT" 2>/dev/null | wc -l)

# Fingerprint 3: version marker (1.0 is the only release)
VER_HIT=$(grep -r -l "version.*1\\.0" --include="*.php" "$WEBROOT" 2>/dev/null | head -n1)

if [ "$VULN_SINKS" -gt 0 ]; then
  echo "VULNERABLE: itsourcecode HMS signatures present and $VULN_SINKS unsanitized SQL sink(s) detected"
  echo "  webroot: $WEBROOT"
  echo "  version marker: ${VER_HIT:-unknown}"
  exit 1
fi

echo "UNKNOWN: itsourcecode artifacts present but no obvious vulnerable sink matched — manual review required"
exit 2