CVE-2026-105384: SQL Injection in UNION HospitalManagementSystem

The UNION HospitalManagementSystem contains a SQL injection vulnerability in an unspecified function of patient_info.php. By manipulating the patient_id parameter, an attacker can perform SQL injection remotely. The project follows a rolling release model, preventing precise version identification for affected or fixed releases. The vulnerability was disclosed via an issue report, but the project has not responded or provided a fix. The CVSS 3.1 score is 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating a remotely exploitable vulnerability with low attack complexity and no privileges or user interaction required, impacting confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated remote attacker to perform SQL injection via the patient_id parameter, potentially leading to unauthorized data access, data modification, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the system. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should monitor official channels for updates. In the meantime, consider applying input validation or web application firewall rules to mitigate SQL injection risks targeting the patient_id parameter.