Fomovet

**Name of the Vulnerable Software and Affected Versions** itsourcecode Hospital Management System version 1.0 **Description** A remote SQL injection exists in the `/viewpatient.php` endpoint. This issue occurs when the `delid` argument is manipulated, allowing an attacker to execute arbitrary SQL commands on the database. **Recommendations** As a temporary workaround, restrict access to the `/viewpatient.php` file or avoid using the `delid` parameter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Hospital Management System version 1.0 **Description** A SQL injection issue exists in the `/viewpaymentreport.php` endpoint. This occurs when the `delid` variable is manipulated, allowing a remote attacker to execute arbitrary SQL commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/viewpaymentreport.php` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Hospital Management System version 1.0 **Description** An issue exists in the Appointment Handler component within the `/appointmentdetail.php` endpoint. Remote manipulation of the `editid` argument allows for SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. **Recommendations** Update itsourcecode Hospital Management System version 1.0 to a patched version. As a temporary mitigation, restrict access to the `/appointmentdetail.php` endpoint or avoid using the `editid` parameter until a fix is applied.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Hospital Management System version 1.0 **Description** A remote SQL injection flaw exists in the `/department.php` endpoint. The issue occurs when the `editid` argument is manipulated, allowing an attacker to execute arbitrary SQL commands on the database. **Recommendations** As a temporary workaround, restrict access to the `/department.php` endpoint or avoid using the `editid` parameter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Hospital Management System version 1.0 **Description** A SQL injection flaw exists in the `/departmentDoctor.php` endpoint. This issue occurs when the `deptid` argument is manipulated, allowing a remote attacker to execute arbitrary SQL commands. **Recommendations** Update itsourcecode Hospital Management System version 1.0 to a patched version. As a temporary mitigation, restrict access to the `/departmentDoctor.php` endpoint or sanitize the `deptid` parameter.