UNION HospitalManagementSystem CVE-2026-105384

Exploitation requires network access to a deployed instance of UNION HospitalManagementSystem exposing patient_info.php, with the patient_id parameter reaching the vulnerable query; per CVSS AV:N/AC:L/PR:N/UI:N no authentication, special configuration, or user interaction is required against a reachable instance. The primary limiting factor is exposure and deployment scale rather than technical prerequisites: this is a small open-source PHP project with no enterprise footprint, so realistic risk hinges on whether an instance is internet-exposed. No fixed version is available because the project uses a rolling release and has not responded to the report.

Multiple signals point to a LOW real-world priority despite the medium CVSS. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, but all impact metrics are limited (VC:L/VI:L/VA:L, SC/SI/SA:N), yielding a modest 6.9 score. The vector carries E:P (Proof-of-Concept exploit maturity), consistent with the stated public exploit, so publicly available exploit code exists. However, there is NO CISA KEV listing and NO EPSS score provided in the input, so widespread or active exploitation cannot be inferred. The disclosure originates solely from VulDB with the 'exploit' reference pointing to a GitHub issue on a small open-source project (onetwothreeneth/HospitalManagementSystem) that the input states has not responded to the report. The combination of an obscure hobby-grade product, a rolling-release model with no fixed/patched version, and no KEV/EPSS corroboration means this is a genuine-but-low-priority bug: easy to exploit in principle, but tiny deployment footprint and no evidence of real-world attacker interest. EPSS data is MISSING and should be checked before deprioritizing entirely.

A remote, unauthenticated attacker sends a crafted value in the patient_id parameter to patient_info.php, injecting SQL that the application executes against its backend database. A public proof-of-concept exists (referenced via the project's GitHub issue tracker), lowering the skill needed to reproduce the attack. Given the limited CVSS impact ratings, a realistic outcome is partial disclosure or modification of patient records rather than full database or host compromise.