Loading vulnerability…
SQL Injection in Imaster Patient Records Management System complaints.php (id parameter)
Imaster’s Patient Records Management System contains a SQL injection vulnerability in the administrative endpoint "/projects/hospital/admin/complaints.php". The issue is triggered by improper neutralization of special elements in SQL commands constructed using the user-supplied "id" parameter, allowing an attacker to inject SQL when the application processes requests to this endpoint.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables SQL injection against the backend database, which may allow an attacker to read and modify database contents. Depending on the application/database configuration, this can also potentially lead to authentication bypass and, in some environments, escalation to remote code execution via database features or chained weaknesses.
If you can’t patch tonight, do this now.
Until a vendor fix is available, restrict access to "/projects/hospital/admin/complaints.php" (and related admin paths) to trusted networks/users (e.g., VPN, IP allowlisting), ensure strong authentication/authorization controls for admin endpoints, deploy WAF rules to detect/block SQLi attempts targeting the "id" parameter, and increase monitoring/logging for suspicious requests to the endpoint.
Patch, then assume compromise.
Apply the vendor-provided fix/update when available. Refactor the affected code path in complaints.php to use parameterized queries/prepared statements for the "id" parameter, enforce strict server-side validation (e.g., integer type enforcement/allowlisting), and remove any dynamic SQL concatenation patterns across similar endpoints.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.