SQL Injection in itsourcecode Hospital Management System /doctortimings.php editid Parameter

CVE-2026-13548 is a textbook SQL injection in the editid parameter of /doctortimings.php in itsourcecode Hospital Management System 1.0. The application concatenates user input directly into SQL queries with no parameterization or input validation. The affected product is a free PHP/MySQL student capstone project distributed on itsourcecode.com for BSIT thesis work — it runs on XAMPP/WAMP and is designed to be downloaded, unzipped, and demoed for a professor. It is not a commercial product, has no vendor support, no patch pipeline, no update mechanism, and no known production deployment anywhere. Only version 1.0 exists; there are no other releases.

The vendor severity of MEDIUM (6.3) is technically accurate for the SQL injection mechanics — AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L correctly describes what happens if you exploit a PHP page that concatenates $_GET['editid'] into a query. But the score is entirely disconnected from real-world risk because the affected software has an installed base of approximately zero in any enterprise environment. This CVE is one of dozens of nearly identical SQL injection findings across this same student project (CVE-2026-13530, -13531, -75086, -75087, -75088, -19894, -19934, -14773, -14774, -16334, -19767, -20000, and more), each targeting a different .php file and a different delid or editid parameter. The entire product is a CVE farm — a researcher systematically running sqlmap against every endpoint of a homework project.

Sources.

1. OpenCVE — CVE-2026-13548
2. GitHub Advisory / PoC by Vivian (ltranquility)
3. VulDB Entry 374556
4. itsourcecode.com — Hospital Management System Project
5. NVD — CVE-2026-13548
6. Hol Security — CVE-2026-13548
7. Threat Radar — itsourcecode HMS SQLi CVEs

Run from any auditor workstation or scanner host with curl installed. Invoke as bash check_cve_2026_13548.sh http://target-host. No special privileges required — this only sends HTTP GET requests to check for the presence of the vulnerable application.

#!/usr/bin/env bash
set -euo pipefail
# CVE-2026-13548 checker: itsourcecode Hospital Management System 1.0
# SQL injection in /doctortimings.php via editid parameter
# Usage: bash check_cve_2026_13548.sh http://target-host

TARGET="${1:?Usage: $0 http://target-host}"
ENDPOINT="${TARGET}/doctortimings.php"

echo "[*] Checking for itsourcecode Hospital Management System at ${TARGET}"

# Step 1: Check if the endpoint exists
HTTP_CODE=$(curl -sk -o /dev/null -w '%{http_code}' "${ENDPOINT}" 2>/dev/null || echo "000")
if [ "$HTTP_CODE" = "000" ]; then
  echo "[!] UNKNOWN - Cannot reach ${ENDPOINT}"
  exit 2
fi

if [ "$HTTP_CODE" = "404" ]; then
  echo "[+] PATCHED/NOT PRESENT - /doctortimings.php not found (HTTP 404)"
  exit 0
fi

# Step 2: Check for the telltale page content
BODY=$(curl -sk "${ENDPOINT}" 2>/dev/null)
if echo "$BODY" | grep -qi "Hospital Management System"; then
  echo "[!] VULNERABLE - itsourcecode Hospital Management System detected at ${ENDPOINT}"
  echo "    /doctortimings.php is reachable (HTTP ${HTTP_CODE})"
  echo "    This application has systemic SQL injection. Decommission immediately."
  exit 1
else
  echo "[?] UNKNOWN - ${ENDPOINT} responded (HTTP ${HTTP_CODE}) but content does not match expected application."
  exit 2
fi