CVE Intelligence
Analysis AI-assisted

CVE-2026-2059: SourceCodester Medical Center Portal Management System SQL Injection via emp_edit1.php

CVE-2026-2059 is an SQL injection flaw (CWE-89) in the emp_edit1.php file of SourceCodester Medical Center Portal Management System 1.0, triggered through the ID argument. The record describes remote attack and public disclosure of an exploit, and NVD rates it 9.8 Critical under CVSS 3.1. It is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-2059 is an SQL injection vulnerability (CWE-89) in the emp_edit1.php component of SourceCodester Medical Center Portal Management System 1.0. According to the record, manipulating the ID argument can lead to SQL injection, and the attack may be performed remotely.

Impact

SQL injection can allow an attacker to interact with the application database in ways the developers did not intend, which may affect confidentiality, integrity and availability. NVD's assessment in the record is CVSS 3.1 score 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. VulDB, acting as CNA, lists additional scores of 7.3 (CVSS 3.1), 7.5 (CVSS 2.0) and 5.5 (CVSS 4.0).

Affected products and versions

  • The record identifies version 1.0 of the Medical Center Portal Management System.
  • The description attributes the product to SourceCodester, while the structured affected-product field names Bontrofftech Medical Center Portal Management System. This discrepancy should be checked against the vendor or the original advisory.
  • The record does not identify any fixed version.

Exploitation status

  • The record states that the exploit has been publicly disclosed and may be used.
  • This CVE is not listed in CISA KEV, so KEV does not confirm active exploitation.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • No EPSS data is available in the record.

Remediation and mitigation

  • The record contains no vendor fixed version. Its only fix entry is a mitigation reference to a third-party GitHub issue. The absence of a patch in the record does not prove that no fix exists.
  • Restrict access to the affected application, keeping it off public networks where possible and placing it behind strong authentication and access controls.
  • Inventory all deployments of this product and confirm whether the emp_edit1.php component is present.
  • Ask the maintainer or distributor for an update that uses parameterized queries and strict input validation for the ID parameter, or apply equivalent fixes after internal review.
  • Review the mitigation guidance in the linked references before choosing actions.

Detection guidance

  • Review web server and application logs for unusual requests to emp_edit1.php, especially irregular or unexpected values in the ID parameter.
  • Monitor database error messages and abnormal query patterns originating from the web application.
  • Consider web application firewall rules and alerts for SQL-related anomalies on this endpoint, tuned to limit false positives.

Limitations of the available information

  • The record does not describe the vulnerable code path in detail or provide a vendor advisory.
  • The product attribution is inconsistent between the description (SourceCodester) and the affected-product field (Bontrofftech).
  • No fixed version, EPSS score or SSVC data is available in the record.
  • CVSS scores come from different versions and providers and should be interpreted with that in mind.

Frequently asked questions

What is the vulnerability in CVE-2026-2059?

It is an SQL injection flaw (CWE-89) in the emp_edit1.php file of SourceCodester Medical Center Portal Management System 1.0, triggered by manipulating the ID argument.

Is CVE-2026-2059 known to be actively exploited?

The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The record does say a public exploit has been disclosed and may be used.

Is there a fixed version available?

The record does not identify a fixed version. It lists only a mitigation reference, so the vendor status should be verified directly.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.