A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. (CVE-2026-105385)

The onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d contains a SQL injection vulnerability in an unknown functionality within transaction_details.php. An attacker can manipulate the transaction_id argument remotely to execute SQL injection attacks. The vulnerability was publicly disclosed, and the project was notified early but has not responded or issued a fix. Due to the rolling release model, specific affected or fixed versions are not provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or denial of service. The CVSS score of 7.3 reflects a medium severity with impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a fix is available, consider restricting access to the vulnerable functionality or implementing web application firewall rules to detect and block SQL injection attempts targeting transaction_id.