CVE-2026-104609: onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection
A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function get of the file editaccounts.php. This manipulation of the argument userid/patientid/physicianid/discountsid/servicesid causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments of onetwothreeneth HospitalManagementSystem containing the affected edit_accounts.php functionality may be exposed. The available information identifies revisions up to commit 9ef91ed6007314b6473110ed699dff76d158f61d, but does not provide fixed release versions because the project uses rolling releases.
Does exploitation require authentication or user interaction?
No authentication or user interaction is indicated by the supplied CVSS vector. The vulnerable parameters can be manipulated remotely, and the attack complexity is rated low.
Which inputs should be investigated or restricted?
The affected get function in edit_accounts.php processes the user_id, patient_id, physician_id, discounts_id, and services_id arguments. These inputs should be treated as potentially injectable wherever they reach this endpoint.
Is there evidence that exploitation is practical?
Yes. A public exploit is available, and the CVSS temporal metrics identify proof-of-concept exploit maturity.
Is a vendor fix confirmed?
No. The project was reportedly notified through an issue report but had not responded at the time of publication, and no updated or fixed release is identified in the available data.