CVE-2026-105383
HighCVSS 7.3Summary
A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of the file php/controller.php. Such manipulation of the argument transaction_idS leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Risk Assessment
A remote attacker can exploit the SQL injection to gain unauthorized access to medical data, modify it, or corrupt the database, potentially compromising the confidentiality and integrity of the system.
Recommendation
Apply patches or updates if available, or restrict access to the system and monitor logs for suspicious activity. Contact the vendor for support.
Other vulnerabilities in HospitalManagementSystem
See all- CVE-2026-105382High
A flaw was found in onetwothreeneth HospitalManagementSystem in the update_subaccount function of php/controller.php (Account Administration component). Manipulating the user_id argument causes improper authorization, and the vulnerability can be exploited remotely. The exploit has been published and may be used.
- CVE-2026-104638Medium
onetwothreeneth HospitalManagementSystem (up to 9ef91ed6007314b6473110ed699dff76d158f61d) has a vulnerability in php/sessions.php where manipulation of the ID argument leads to improper authentication. Remote exploitation is possible and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of the file php/controller.php. Such manipulation of the argument transaction_idS leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS