A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. (CVE-2026-105383)

CVE-2026-105383 describes a SQL injection vulnerability in onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d. The flaw exists in an unspecified function within php/controller.php where the transaction_idS argument is improperly sanitized, allowing remote attackers to inject SQL commands. The product's rolling release model prevents precise version identification. The vulnerability was disclosed publicly, but the project has not issued a response or patch. The CVSS 3.1 score is 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating a remotely exploitable flaw with low attack complexity and no privileges or user interaction required, impacting confidentiality, integrity, and availability at a low level.

Successful exploitation of this vulnerability could allow remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access, data manipulation, or disruption of service. The impact includes partial loss of confidentiality, integrity, and availability of the affected system. However, no known exploits are currently active in the wild, and the severity is rated medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The project has not responded to the issue report, and no official fix is available at this time. Users should monitor the vendor's communications for updates and consider implementing application-layer protections such as input validation or web application firewalls to mitigate SQL injection risks in the interim.