CVE-2026-75088

This SQL injection in the billing module of a 1.0 hospital management system merits more attention than its modest EPSS score suggests. The vulnerability lives in a view script (viewbilling.php) handling a 'delid' parameter with no input validation — a pattern that should have been caught in basic code review, which suggests the development lifecycle had no security gate between implementation and deployment. That's the real concern: this isn't a sophisticated 0-day, it's a publicly disclosed injection in a parameter anyone can fuzz, and it shipped anyway. The blast radius is the critical gap in standard risk assessment. Hospital management systems aren't isolated billing applications — they're integrated nodes connected to insurance verification APIs, pharmacy dispensing systems, lab result feeds, patient scheduling engines, and EMR/EHR systems. An attacker achieving arbitrary SQL execution through this injection doesn't stop at the billing database. Depending on how the application connects to shared infrastructure (almost always with shared credentials for operational convenience), this becomes a pivot point to patient records, insurance fraud potential, and regulatory cascades triggering HIPAA audit requirements across every system that touched the same patient population. The vendor context compounds the risk. Itsourcecode operates as a code marketplace ecosystem — this software was likely written by contractors optimizing for completed-and-moved-on, not long-term maintenance. A hospital can't simply rip out their billing system without replacing the EMR connection, insurance API hooks, and pharmacy interface. That lock-in is what makes abandoned 1.0 healthcare software dangerous: trivially exploitable AND structurally stuck. The patch may exist, but propagation depends on vendor updates the hospital may never receive, customer-paid upgrades, or regulatory recertification cycles that have nothing to do with security urgency. For defenders: verify whether your deployment shares database credentials between the billing module and other hospital systems — assume lateral movement is possible until proven otherwise. Map the integration graph and treat the billing database as a potential entry point to the entire patient data environment. The exposure window isn't measured from disclosure to exploit; it's measured from disclosure to actual remediation in an environment with no automated update path and maintenance windows already months behind. Assume siblings exist — the same process failures that produced 'delid' in viewbilling.php almost certainly produced undocumented injections in adjacent billing functions.

Reviewed through automated stages and approved by a human before publication.