A vulnerability was identified in itsourcecode Hospital Management System 1

CVE-2026-13548 is an authenticated SQL injection in /doctortimings.php via the editid parameter of itsourcecode's *Hospital Management System v1.0* — a free PHP/MySQL demo project distributed via itsourcecode.com as student/portfolio material. An attacker who already holds a valid login can inject arbitrary SQL via editid, reading, modifying, or destroying database contents. The codebase has *no version branching* — there is one v1.0 and dozens of sibling CVEs (13520, 13530, 13531, etc.) reporting the same mysqli_query($_GET[...]) antipattern in adjacent files.

The vendor MEDIUM/6.3 rating is technically defensible under CVSS math (network vector, low complexity, low privs, low CIA) but operationally inflated. This is not enterprise software. It has no support contract, no patch pipeline, and almost no real-world deployments outside coursework, portfolios, and the occasional under-resourced clinic running a copy-pasted intern project. For a defender managing 10,000 hosts: if you find this in production, the SQLi is the least of your problems.

Why this verdict

• Authentication required (PR:L): the attacker must already hold valid app credentials — this is post-access SQLi, not unauthenticated RCE.
• Installed base is effectively zero in the enterprise: itsourcecode is a free PHP teaching codebase; no Fortune-2000 procurement, no HIPAA-audited deployment, no support contract.
• Role multiplier — low-value role: the affected component is a standalone PHP/MySQL line-of-business app. It is not an IdP, hypervisor, CA, PAM, backup server, EDR, or network edge appliance. Worst-case blast radius is one application database with partial CIA impact.
• Role multiplier — typical role: small clinic intranet server. Compromise = PHI exposure in that one tenant; no lateral pivot path inherent to the bug.
• Role multiplier — high-value role: does not exist. This software is never canonically deployed as identity, trust, or orchestration infrastructure. Floor logic does not apply.
• No KEV, no campaigns, no EPSS heat. Sibling CVEs in the same product family carry sub-1st-percentile EPSS scores and zero observed exploitation.
• No patch exists and likely never will — but a missing patch on abandoned demo software is a *procurement* failure, not a severity multiplier.

Why not higher?

MEDIUM would require either a credible enterprise installed base, unauthenticated exploitation, or a high-value-role deployment pattern. None apply: PR:L gates the attack, installed base is academic, and the impact ceiling is one app schema with partial CIA.

Why not lower?

IGNORE is wrong because the bug is real, the PoC works, and clinics *do* sometimes deploy this. If you have it in your fleet, you need to know — and you need to replace it, not patch it. LOW captures backlog-hygiene urgency without misallocating SOC attention.

1. Inventory first — confirm whether you actually run itsourcecode HMS — Run an authenticated scan or grep your CMDB for itsourcecode, hospital management, doctortimings.php. If nothing matches, close the ticket. No mitigation SLA applies at LOW; this is pure asset discovery hygiene.
2. If found, take the app offline or wall it behind VPN+MFA — There is no vendor patch. The only sustainable control is to remove WAN exposure entirely and gate it behind authenticated VPN with MFA. Schedule a replacement project (commercial EMR or maintained open-source like OpenEMR) — treat as backlog hygiene under the 365-day remediation window since no mitigation SLA applies at LOW.
3. Force a credential reset and disable self-registration — Because the bug requires PR:L, the entire attack surface is gated by who holds an account. Rotate all app credentials, kill default admin/admin, and turn off self-signup if present.
4. Drop a WAF rule on editid and sibling parameters — ModSecurity CRS rules 942100–942470 already cover this. Verify they are in blocking mode on this vhost. Also instrument the *other* itsourcecode CVEs — siblings 13520, 13530, 13531 hit different files with identical patterns.
5. Tighten the MySQL service account — Strip FILE, PROCESS, and any DDL privileges beyond what the app strictly needs. This is what keeps a C:L/I:L/A:L outcome from being upgraded by an attacker pivoting to OS-level via INTO OUTFILE.

Run on your auditor workstation or any host that can reach the target app. Provide the target base URL and a valid authenticated session cookie. No root required. Example: ./check_cve_2026_13548.sh https://hms.internal.example.com 'PHPSESSID=abcdef123456'.

#!/usr/bin/env bash
# noisgate verification — CVE-2026-13548
# itsourcecode Hospital Management System 1.0 — SQLi in /doctortimings.php (editid)
# Usage: ./check_cve_2026_13548.sh <base_url> <session_cookie>
set -u

BASE="${1:-}"
COOKIE="${2:-}"

if [[ -z "$BASE" || -z "$COOKIE" ]]; then
  echo "Usage: $0 <base_url> <session_cookie>" >&2
  exit 2
fi

TARGET="${BASE%/}/doctortimings.php"

# 1) Confirm the endpoint exists at all
CODE=$(curl -s -o /dev/null -w '%{http_code}' -b "$COOKIE" "$TARGET?editid=1")
if [[ "$CODE" == "404" ]]; then
  echo "PATCHED (endpoint not present — likely not itsourcecode HMS)"
  exit 0
fi

# 2) Time-based blind SQLi probe — 5s SLEEP
START=$(date +%s)
curl -s -o /dev/null -b "$COOKIE" --max-time 15 \
  "$TARGET?editid=1%20AND%20SLEEP(5)--%20-"
END=$(date +%s)
DELTA=$((END-START))

if (( DELTA >= 5 )); then
  echo "VULNERABLE (time-based SQLi confirmed on editid, delay=${DELTA}s)"
  exit 1
fi

# 3) Error-based probe — broken quote
RESP=$(curl -s -b "$COOKIE" --max-time 10 "$TARGET?editid=1'")
if echo "$RESP" | grep -Eqi 'sql syntax|mysqli?_|mysql_fetch|you have an error in your sql'; then
  echo "VULNERABLE (error-based SQLi confirmed — DB error string leaked)"
  exit 1
fi

echo "UNKNOWN (endpoint reachable but no injection signal — verify cookie validity)"
exit 3

Sources

1. Vulnerability-Lookup — CVE-2026-13548
2. GitHub Security Advisory GHSA-pqf9-gv8x-vr6w
3. VulDB CVE index
4. OffSeq Threat Radar — sibling CVE-2026-13520 (same codebase)
5. OffSeq Threat Radar — sibling CVE-2026-13530
6. OffSeq Threat Radar — sibling CVE-2026-13531
7. CWE-74 — Injection
8. OWASP SQL Injection Prevention Cheat Sheet