HospitalManagementSystem CVE-2026-105383

Exploitation targets the transaction_idS argument processed by php/controller.php in onetwothreeneth HospitalManagementSystem; an attacker must be able to reach that endpoint and submit the parameter. The CVSS vector asserts no authentication (PR:N) and no user interaction (UI:N), but the advisory does not confirm whether controller.php is exposed before application login - in a deployed instance the transaction endpoint may require a valid session, which would limit exploitation to authenticated users. Because the product is a rolling release with no version boundaries, any current checkout up to commit 9ef91ed6007314b6473110ed699dff76d158f61d is affected, and there is no patched release to upgrade to.

This is a moderate-risk SQL injection (CWE-89) that is unlikely to be an urgent enterprise priority despite remote, unauthenticated reachability. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-based, low-complexity attack requiring no privileges or user interaction, but impact is rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), yielding a modest 5.5 Medium score. The input carries E:P (Proof-of-Concept) and a publicly available exploit code exists via the GitHub issue report, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active exploitation - only disclosed POC. The dominant mitigating factor is prevalence: this is an obscure hobby/student-style GitHub project with negligible production footprint, so the realistic attacker population and target surface are tiny. Note a conflict worth flagging: PR:N claims no authentication, yet controller.php transaction handling may sit behind application login in real deployments - the advisory does not confirm whether the vulnerable endpoint is reachable pre-authentication, so treat 'unauthenticated' as vector-derived, not vendor-confirmed.

A remote attacker submits a crafted value in the transaction_idS parameter to php/controller.php, injecting SQL that the application concatenates into a database query. Because publicly available exploit code exists (referenced in the project's GitHub issue tracker), an attacker can replay it directly to extract or manipulate database records. Given the Low impact rating, realistic outcomes are partial data disclosure or tampering rather than full database compromise.