CVE-2026-105383: onetwothreeneth HospitalManagementSystem controller.php sql injection
A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of the file php/controller.php. Such manipulation of the argument transactionidS leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is remotely exploitable and requires no privileges or user interaction according to the supplied vector. An attacker able to reach the affected application's controller endpoint may attempt to manipulate the transaction_idS argument.
Are fixed versions available?
No affected or updated release versions are available because the product uses a rolling-release model. The affected code is identified as versions up to commit 9ef91ed6007314b6473110ed699dff76d158f61d.
Is there a public exploit?
Yes. The exploit has been publicly disclosed and may be used, increasing the urgency of reviewing exposed deployments.
What can be done while a patch is unavailable?
Restrict remote access to the application where possible, especially access to the controller endpoint, and filter or monitor requests containing the transaction_idS parameter for SQL-injection attempts. The project was notified through an issue report but had not responded at the time of the report.