A weakness has been identified in itsourcecode Hospital Management System 1

CVE-2026-13541 is a CWE-74 injection flaw in itsourcecode Hospital Management System 1.0 — a free PHP/MySQL sample project published on itsourcecode.com aimed at students and CS coursework, not a commercial HMS product. The vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L confirms it requires an *authenticated* low-privilege account, can be reached over the network, and yields only low impact across C/I/A — meaning partial DB read/write within the app's own scope, not host takeover.

Vendor severity of MEDIUM (6.3) is the CVSS-calculator default for that vector and is technically accurate in isolation, but it ignores deployment reality. This codebase has effectively zero footprint in enterprise hospital IT (real hospitals run Epic, Cerner/Oracle Health, Meditech, Allscripts). The only realistic targets are student lab boxes and abandoned shared-hosting demos — so practical risk is far lower than the score implies.

Why this verdict

• Negligible installed base: itsourcecode HMS 1.0 is a downloadable student project — not Epic, Cerner, Meditech, or any commercial HMS. Real hospitals do not run this code, so the deployment-role spectrum is dominated by lab VMs (role (a)).
• Authenticated precondition (PR:L): the attacker must already hold an account, removing this from opportunistic mass-exploitation chains.
• Scope:Unchanged + all-Low CIA: the vector itself caps damage at partial DB read/write within the app — no host RCE, no lateral movement, no privilege escalation documented.
• Role multiplier: no plausible high-value-role deployment exists for this component — it is not an IdP, hypervisor, PAM, CA, backup system, EDR, or network edge appliance. The role-multiplier floor does not engage.
• No KEV, no campaigns, no EPSS pressure: zero observed attacker interest in the itsourcecode CVE cluster historically.

Why not higher?

Higher than LOW would require either a real enterprise installed base, removal of the auth requirement, or a chain to host/domain compromise — none of which exist. The vector itself ceilings impact at Low/Low/Low with Scope Unchanged.

Why not lower?

Not IGNORE because the bug is real, a PoC pattern is trivially derivable from the sibling CVE cluster, and a small number of internet-exposed instances do exist. If you are one of the handful of orgs that *did* deploy this for a pilot, you still need to act — just not urgently.

1. Inventory: confirm you are not running itsourcecode HMS anywhere — Search your asset database and web-app inventory (BurpSuite Enterprise, Qualys WAS, Tenable WAS) for the string Hospital Management System in HTML titles and the path hospital-management-system-in-php. No mitigation SLA applies at LOW — complete within 30 days as backlog hygiene.
2. If found, remove or air-gap the instance — This codebase is unmaintained and contains a cluster of unpatched injection bugs. Migration to a maintained platform (or simple decommission) is the correct response. There is no vendor patch coming.
3. If you must keep it running short-term, place a WAF in front — ModSecurity OWASP CRS in paranoia level 2 will block sqlmap-style payloads on the vulnerable parameter. Pair with mod_security audit logging routed to your SIEM.
4. Disable self-registration and rotate any default creds — The PR:L precondition is the friction point — keeping account issuance restricted to vetted users denies the unauthenticated attacker pool.

Run on the web server hosting any suspected itsourcecode HMS instance, as the user owning the document root (e.g. www-data). Invoke as ./check-cve-2026-13541.sh /var/www/html. Read-only — no privileges beyond filesystem read on the webroot are required.

#!/usr/bin/env bash
# noisgate verifier: CVE-2026-13541 — itsourcecode HMS 1.0 injection (CWE-74)
# Usage: ./check-cve-2026-13541.sh <webroot>
set -u

WEBROOT="${1:-/var/www/html}"

if [ ! -d "$WEBROOT" ]; then
  echo "UNKNOWN: webroot $WEBROOT not found"
  exit 2
fi

# Fingerprint 1: project signature files
SIG_HITS=0
for needle in "Hospital Management System" "hms_db" "itsourcecode"; do
  if grep -r -l --include="*.php" --include="*.sql" -- "$needle" "$WEBROOT" >/dev/null 2>&1; then
    SIG_HITS=$((SIG_HITS+1))
  fi
done

if [ "$SIG_HITS" -eq 0 ]; then
  echo "PATCHED: no itsourcecode HMS artifacts found under $WEBROOT"
  exit 0
fi

# Fingerprint 2: known vulnerable pattern — unsanitized concatenation into mysqli_query
VULN_SINKS=$(grep -r -E "mysqli_query\s*\([^,]+,\s*[\"'][^\"']*\\\$_(GET|POST|REQUEST)" \
  --include="*.php" "$WEBROOT" 2>/dev/null | wc -l)

# Fingerprint 3: version marker (1.0 is the only release)
VER_HIT=$(grep -r -l "version.*1\\.0" --include="*.php" "$WEBROOT" 2>/dev/null | head -n1)

if [ "$VULN_SINKS" -gt 0 ]; then
  echo "VULNERABLE: itsourcecode HMS signatures present and $VULN_SINKS unsanitized SQL sink(s) detected"
  echo "  webroot: $WEBROOT"
  echo "  version marker: ${VER_HIT:-unknown}"
  exit 1
fi

echo "UNKNOWN: itsourcecode artifacts present but no obvious vulnerable sink matched — manual review required"
exit 2

Sources

1. GitHub Advisory Database (unreviewed advisories)
2. OffSeq Threat Radar — itsourcecode HMS CVE cluster (CVE-2026-13530)
3. OffSeq Threat Radar — itsourcecode HMS (CVE-2026-13531)
4. OffSeq Threat Radar — itsourcecode HMS (CVE-2026-13520)
5. TheHackerWire — CVE-2026-13520
6. Vulnerability-Lookup — CVE-2026-13531
7. CISA Known Exploited Vulnerabilities Catalog
8. CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component