Hospitalmanagementsystem
Monthly
Unauthenticated SQL injection in onetwothreeneth HospitalManagementSystem (PHP web app) lets a remote attacker inject arbitrary SQL through the transaction_id argument handled by the get function in print.php, allowing read and limited modification of the underlying database. The CVSS v4.0 vector (AV:N/AC:L/PR:N/UI:N, E:P) confirms remote, unauthenticated exploitation with no user interaction, and a publicly available exploit code exists (a proof-of-concept was filed as GitHub issue #11). Exploitation is constrained less by technique than by exposure: the application is an obscure open-source project with limited real-world deployment, so real-world risk is real but lower priority than the numeric score alone suggests.
Unauthenticated SQL injection in onetwothreeneth HospitalManagementSystem (rolling release, confirmed vulnerable through commit 9ef91ed6007314b6473110ed699dff76d158f61d) lets remote attackers inject arbitrary SQL through the transaction_id parameter of transaction_details.php, exposing or altering database contents such as patient and billing records. Publicly available exploit code exists (disclosed via a public GitHub issue), and exploitation requires no authentication or user interaction, though its CVSS 4.0 base score of 6.9 reflects limited confidentiality, integrity, and availability impact rather than total compromise. There is no CISA KEV entry confirming active exploitation and no vendor patch: the project was notified through an issue report but has not responded, and the rolling-release model means no fixed version has been published.
SQL injection in UNION HospitalManagementSystem lets remote, unauthenticated attackers manipulate the patient_id parameter in patient_info.php to read or modify limited data in the underlying database. The flaw affects a rolling-release PHP project, with publicly available exploit code and no fixed version identified because the maintainers have not responded; exploitation requires a deployed, reachable instance. Despite the medium CVSS, real-world priority is low because this is a small open-source hospital management system without an enterprise footprint.
SQL injection in onetwothreeneth HospitalManagementSystem lets remote attackers execute arbitrary SQL through the transaction_idS parameter handled by php/controller.php, allowing limited confidentiality and integrity impact (CVSS 4.0 base 5.5). Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and the project has not released a fix or responded to the report. The CVSS vector indicates unauthenticated reachability (PR:N), though the advisory does not confirm whether the vulnerable endpoint is accessible before application login, so deployed instances that require a session may limit the attack to authenticated users.
Improper authorization in onetwothreeneth HospitalManagementSystem (Account Administration component) allows remote attackers to modify arbitrary user subaccounts by manipulating the user_id parameter in the update_subaccount function of php/controller.php. Public exploit code exists, and the independent assessment indicates the flaw is an IDOR-style defect that likely requires an authenticated session, with low impact to confidentiality, integrity, and availability. No vendor patch is available; the project was notified but has not responded, and version details are unavailable due to the rolling release model.
Unrestricted file upload in onetwothreeneth HospitalManagementSystem lets a remote attacker submit arbitrary files through the 'img' parameter handled by the add_patient, add_physician, add_account, update_account, update_subaccount, edit_physician, and edit_patient actions in php/controller.php, potentially leading to server-side code execution if the upload lands in a web-accessible, script-enabled directory. The project ships on a rolling-release basis, so no fixed or affected version numbers are published, and publicly available exploit code exists (no CISA KEV listing and no EPSS score was supplied). The vendor's CVSS 4.0 vector scores this 5.5 with PR:N, but the underlying actions are account and record management functions that are normally gated behind an authenticated admin or staff session, so effective exploitability depends on whether the target deployment actually enforces login on those endpoints.
Unauthenticated SQL injection in onetwothreeneth HospitalManagementSystem lets remote attackers inject arbitrary SQL through the user_id, patient_id, physician_id, discounts_id, and services_id parameters handled by the get function in edit_accounts.php, allowing them to read from or manipulate the underlying database. The CVSS 4.0 base score is 5.5 with a PR:N/UI:N vector, so no credentials or user interaction are required against an affected build, although the assessed impact is limited to low confidentiality, integrity, and availability loss. Publicly available exploit code exists and the issue was reported to the project without any response, but there is no evidence of confirmed active exploitation (CISA KEV), and realistic exposure is constrained by the project's very small install base and the absence of any fixed release.
Unauthenticated SQL injection in onetwothreeneth HospitalManagementSystem (PHP web app) lets a remote attacker inject arbitrary SQL through the transaction_id argument handled by the get function in print.php, allowing read and limited modification of the underlying database. The CVSS v4.0 vector (AV:N/AC:L/PR:N/UI:N, E:P) confirms remote, unauthenticated exploitation with no user interaction, and a publicly available exploit code exists (a proof-of-concept was filed as GitHub issue #11). Exploitation is constrained less by technique than by exposure: the application is an obscure open-source project with limited real-world deployment, so real-world risk is real but lower priority than the numeric score alone suggests.
Unauthenticated SQL injection in onetwothreeneth HospitalManagementSystem (rolling release, confirmed vulnerable through commit 9ef91ed6007314b6473110ed699dff76d158f61d) lets remote attackers inject arbitrary SQL through the transaction_id parameter of transaction_details.php, exposing or altering database contents such as patient and billing records. Publicly available exploit code exists (disclosed via a public GitHub issue), and exploitation requires no authentication or user interaction, though its CVSS 4.0 base score of 6.9 reflects limited confidentiality, integrity, and availability impact rather than total compromise. There is no CISA KEV entry confirming active exploitation and no vendor patch: the project was notified through an issue report but has not responded, and the rolling-release model means no fixed version has been published.
SQL injection in UNION HospitalManagementSystem lets remote, unauthenticated attackers manipulate the patient_id parameter in patient_info.php to read or modify limited data in the underlying database. The flaw affects a rolling-release PHP project, with publicly available exploit code and no fixed version identified because the maintainers have not responded; exploitation requires a deployed, reachable instance. Despite the medium CVSS, real-world priority is low because this is a small open-source hospital management system without an enterprise footprint.
SQL injection in onetwothreeneth HospitalManagementSystem lets remote attackers execute arbitrary SQL through the transaction_idS parameter handled by php/controller.php, allowing limited confidentiality and integrity impact (CVSS 4.0 base 5.5). Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and the project has not released a fix or responded to the report. The CVSS vector indicates unauthenticated reachability (PR:N), though the advisory does not confirm whether the vulnerable endpoint is accessible before application login, so deployed instances that require a session may limit the attack to authenticated users.
Improper authorization in onetwothreeneth HospitalManagementSystem (Account Administration component) allows remote attackers to modify arbitrary user subaccounts by manipulating the user_id parameter in the update_subaccount function of php/controller.php. Public exploit code exists, and the independent assessment indicates the flaw is an IDOR-style defect that likely requires an authenticated session, with low impact to confidentiality, integrity, and availability. No vendor patch is available; the project was notified but has not responded, and version details are unavailable due to the rolling release model.
Unrestricted file upload in onetwothreeneth HospitalManagementSystem lets a remote attacker submit arbitrary files through the 'img' parameter handled by the add_patient, add_physician, add_account, update_account, update_subaccount, edit_physician, and edit_patient actions in php/controller.php, potentially leading to server-side code execution if the upload lands in a web-accessible, script-enabled directory. The project ships on a rolling-release basis, so no fixed or affected version numbers are published, and publicly available exploit code exists (no CISA KEV listing and no EPSS score was supplied). The vendor's CVSS 4.0 vector scores this 5.5 with PR:N, but the underlying actions are account and record management functions that are normally gated behind an authenticated admin or staff session, so effective exploitability depends on whether the target deployment actually enforces login on those endpoints.
Unauthenticated SQL injection in onetwothreeneth HospitalManagementSystem lets remote attackers inject arbitrary SQL through the user_id, patient_id, physician_id, discounts_id, and services_id parameters handled by the get function in edit_accounts.php, allowing them to read from or manipulate the underlying database. The CVSS 4.0 base score is 5.5 with a PR:N/UI:N vector, so no credentials or user interaction are required against an affected build, although the assessed impact is limited to low confidentiality, integrity, and availability loss. Publicly available exploit code exists and the issue was reported to the project without any response, but there is no evidence of confirmed active exploitation (CISA KEV), and realistic exposure is constrained by the project's very small install base and the absence of any fixed release.