SQL Injection in Hospital Patient Records Management System

A weakness has been identified in SourceCodester Hospitals Patient Records Management System 1.0. Affected is an unknown function of the file /classes/Users.php?f=save. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-10185 exposes a critical SQL injection vulnerability in SourceCodester Hospitals Patient Records Management System version 1.0, specifically within the /classes/Users.php file's save function. An attacker can manipulate the ID parameter to inject arbitrary SQL commands, potentially allowing unauthorized access to sensitive patient data, modification of medical records, or complete database compromise. Healthcare organizations deploying this system face immediate risk to patient privacy (HIPAA compliance implications), data integrity, and operational continuity. The public availability of this exploit significantly increases attack likelihood, making remediation urgent for all affected installations.

Casky's 301 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns associated with this vulnerability across both Initial Access (TA0001) and Reconnaissance (TA0043) phases. Practitioners using Casky would identify suspicious patterns including: malformed SQL syntax in web request logs targeting the /classes/Users.php endpoint, unexpected query string manipulation attempts on the ID parameter, database error messages leaking schema information, and anomalous database connection patterns indicative of SQL injection probing. The platform's skill coverage correlates input validation failures (CWE-74) and improper SQL statement construction (CWE-89) with observable indicators—allowing security teams to detect both active exploitation attempts and misconfigurations that leave systems vulnerable to this specific attack vector.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-10185.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-10185

Casky has 301 skills that investigate the attack patterns behind CVE-2026-10185. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn