HospitalManagementSystem EUVD-2026-92620

No special conditions - remote unauthenticated SQL injection is reachable by manipulating the transaction_id argument passed to the get function in print.php, against default deployments of onetwothreeneth HospitalManagementSystem (AV:N/AC:L/PR:N/UI:N). The only practical limiting factors are deployment-related rather than technical: the affected instance must be network-reachable, and the product itself is an obscure open-source hospital-management application with very limited real-world deployment. No authentication, no user interaction, and no non-default configuration is required.

Signals are largely consistent and point to a genuine but low-to-moderate priority issue. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a trivially reachable, remote, unauthenticated, low-complexity SQL injection, which normally warrants urgency; however, the vulnerable-system impacts are all rated Low (VC:L/VI:L/VA:L) and subsequent-system impacts are None, yielding a moderate 6.9 score. Exploit maturity is E:P (Proof-of-Concept), matching the publicly available exploit referenced in the GitHub issue - so publicly available exploit code exists, but there is NO CISA KEV listing and no EPSS value was provided, so widespread active exploitation is NOT confirmed. The dominant risk-limiter is not technical difficulty but product obscurity: this is a small open-source GitHub project (onetwothreeneth/HospitalManagementSystem) with no enterprise footprint, so mass exploitation is unlikely despite the easy attack path. One caveat: VulDB conservatively scored impacts as Low, but a classic unauthenticated SQL injection frequently permits full database extraction (patient/PII data in a hospital system) - the real confidentiality impact may be higher than VC:L suggests; verify against the actual query context. No patch exists (rolling release, vendor unresponsive), which raises residual risk for anyone actually running this software.

An unauthenticated attacker locates an internet-reachable HospitalManagementSystem instance and sends a crafted request to print.php with a malicious transaction_id value, injecting SQL into the backend query. Because a public proof-of-concept is already published in the project's GitHub issue tracker, the attacker can replay it directly to read or manipulate database records such as transactions and patient data. No authentication or user interaction is required (PR:N/UI:N).