PHPGurukul Hospital Management System manage-users.php sql injection
Priority MEDIUM 56CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
A vulnerability was determined in PHPGurukul Hospital Management System 4.0. This impacts an unknown function of the file /admin/manage-users.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00366 30th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PHPGurukul | Hospital Management System | 4.0 | — | No fix listed | CNA |
- Hospital Management System VendorPHPGurukul Affected 4.0 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:phpgurukul:hospital_management_system:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | PHPGurukul |
- cpe:2.3:a:phpgurukul:hospital_management_system:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·PHPGurukul
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2179
- 2026-10-03 Alias added: GHSA-h7p7-f8wc-8xvh
References
More PHPGurukul Hospital Management System vulnerabilities
- TI-2024-34337 An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute… CVSS 3.1CRITICAL 9.8
- TI-2023-15100 A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0… CVSS 3.1CRITICAL 9.8
- TI-2020-16228 A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital… CVSS 3.1CRITICAL 9.8
- TI-2024-00330 PHPGurukul Hospital Management System patient-search.php sql injection CVSS 3.1CRITICAL 9.8
- TI-2024-00329 PHPGurukul Hospital Management System change-password.php sql injection CVSS 3.1CRITICAL 9.8
- TI-2024-00327 PHPGurukul Hospital Management System edit-doctor-specialization.php sql injection CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-2179 · CVE Program
- CVE-2026-2179 · NVD
- FIRST EPSS
- GHSA-h7p7-f8wc-8xvh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences