CVE-2022-34590 Scanner

Hospital Management System (HMS) is a software solution designed to streamline the administration and management of healthcare facilities. This system is commonly used in hospitals and clinics to automate patient records keeping, medication administration, billing, scheduling, and inventory management. It provides healthcare providers with a centralized platform to manage all aspects of their operations and enhance patient care while reducing costs.

CVE-2022-34590 is a critical SQL injection vulnerability that arises due to insufficient input validation in the editid parameter. Attackers can inject malicious SQL code through this parameter, which is directly concatenated into database queries without proper sanitization. This flaw allows unauthorized database manipulation.

The vulnerability specifically affects the editid parameter in the /HMS/admin.php endpoint. By crafting a malicious input, an attacker can bypass authentication and execute arbitrary SQL commands, such as retrieving user credentials or modifying patient records. The injection point is in the SQL query that processes user-supplied data for editing records.

If exploited, an attacker can access sensitive data including patient medical histories, financial information, and employee credentials. This can lead to identity theft, medical fraud, and severe reputational damage for the healthcare facility. The CVSS score of 7.2 highlights the high risk of data breach and system compromise.