HospitalManagementSystem CVE-2026-105385

Exploitation requires that the HospitalManagementSystem application be deployed and network-reachable, with the transaction_details.php endpoint accessible to the attacker; the injectable transaction_id parameter must be reachable without authentication, consistent with PR:N. No special non-default configuration is named in the description, and no user interaction is needed (UI:N). The primary LIMITING factor is deployment footprint: this is an obscure open-source PHP project with a rolling release and no vendor patch, so realistic exposure depends on whether an organization self-hosts it; there is no CISA KEV evidence of active exploitation, and exploit maturity is only POC-grade (E:P).

This is a textbook VulDB-sourced SQL injection (CWE-89) in an open-source GitHub project, and the aggregate signals point to LOW real-world priority despite a mid-range 6.9 score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction - attractive on paper - but the impact metrics are uniformly LOW (VC:L/VI:L/VA:L), and the E:P (Proof-of-Concept) exploit maturity aligns with the stated 'publicly disclosed' POC rather than active weaponization. There is NO CISA KEV listing and no EPSS score provided in the input, so widespread or automated exploitation cannot be substantiated from the data. The 'exploit' reference is simply the GitHub issue report (issues/10), not a packaged weaponized tool, which is consistent with POC-grade maturity. Key caveat: the vendor rated confidentiality/integrity/availability as only LOW, yet an unauthenticated SQL injection frequently enables full database read or authentication bypass - the LOW impact rating may understate true severity, so the depth of the injection (UNION/blind vs. limited) should be verified against the referenced issue. Net: a legitimate flaw worth patching, but a niche-product, POC-only issue rather than an urgent widespread threat.

A remote, unauthenticated attacker sends a crafted value in the transaction_id parameter to transaction_details.php, injecting SQL that the backend executes against the hospital database. A public proof-of-concept exists (disclosed via the project's GitHub issue tracker), lowering the skill needed to reproduce it; given AV:N/AC:L/PR:N, no authentication or special timing is required to attempt the attack.