CVE-2026-105385: SQL Injection in onetwothreeneth HospitalManagementSystem

CVE-2026-105385 is a SQL injection vulnerability in onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d. The vulnerability exists in an unknown functionality within transaction_details.php where manipulation of the transaction_id parameter can lead to SQL injection. The vulnerability can be exploited remotely without authentication or user interaction. The product follows a rolling release model, and no specific affected or fixed versions have been disclosed. The vulnerability was responsibly disclosed to the project, which has not yet responded or issued a fix. Public exploit code is available, but no confirmed exploitation in the wild is known.

Successful exploitation of this vulnerability allows remote attackers to perform SQL injection attacks via the transaction_id parameter. This can lead to unauthorized access, data leakage, or modification of the database contents. The vulnerability does not require privileges or user interaction, increasing its risk. However, the CVSS score of 6.9 (medium severity) indicates that the impact is significant but not critical.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor for updates from the vendor. In the meantime, consider implementing web application firewalls or input validation controls to mitigate SQL injection risks related to the transaction_id parameter.