CVE-2026-105383: SQL Injection in onetwothreeneth HospitalManagementSystem

This vulnerability in onetwothreeneth HospitalManagementSystem allows remote attackers to perform SQL injection via the transaction_idS parameter in the php/controller.php file. The injection flaw enables unauthorized manipulation of backend database queries. The product's rolling release model means version information for affected or patched releases is unavailable. The project was notified early but has not issued a fix or response. The vulnerability has a CVSS 4.0 score of 6.9, indicating medium severity, and public exploit code is available.

Successful exploitation can lead to unauthorized SQL commands being executed on the backend database, potentially allowing data leakage, modification, or other database impacts. The vulnerability is remotely exploitable without authentication, increasing the attack surface. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, consistent with medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor for updates from the vendor. Until a patch is available, consider applying web application firewall rules to detect and block SQL injection attempts targeting the transaction_idS parameter.