CVE-2026-8785 projectworlds CVE debrief

Who should care

Anyone operating or maintaining projectworlds hospital-management-system-in-php 1.0, especially teams exposing update_info.php to the network, plus application security, web platform, and incident response teams responsible for PHP applications and database-backed patient portals.

Technical summary

The vulnerability is a SQL injection in a GET parameter handler. In the affected flow, getAllPatientDetail in update_info.php processes the appointment_no parameter in a way that allows attacker-controlled input to alter database queries. The supplied CVE metadata rates the issue as network exploitable with no privileges or user interaction required, and the weakness mapping includes CWE-89 (SQL Injection) and CWE-74 (Injection).

Defensive priority

Medium, elevated for any internet-facing installation.

Recommended defensive actions

• Identify whether projectworlds hospital-management-system-in-php 1.0 is deployed anywhere in your environment, including legacy or unmanaged web servers.
• Review update_info.php and the getAllPatientDetail path for unsafe query construction involving appointment_no.
• Apply a fix from the vendor or maintainers if one becomes available; if not, consider removing or isolating the affected application.
• Use parameterized queries and strict server-side validation for all database inputs in the affected code path.
• Restrict network exposure to the application and database where possible, and monitor for anomalous requests targeting appointment_no.
• Check logs and database telemetry for suspicious query patterns consistent with SQL injection attempts.
• If the application handles sensitive patient data, prioritize remediation and consider compensating controls until the issue is resolved.

Evidence notes

All technical claims here are limited to the supplied corpus: the CVE description, NVD metadata, and the referenced source links. The source metadata identifies the affected function as getAllPatientDetail in update_info.php and the parameter as appointment_no. NVD metadata also lists CWE-89 and CWE-74 and marks the vuln status as Received. The record’s vendor attribution is low-confidence in the supplied data, so product identification should be treated cautiously even though the description names projectworlds hospital-management-system-in-php 1.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.