SQL Injection Vulnerability in HospitalManagementSystem (CVE-2026-104609)

A SQL injection vulnerability has been identified in the onetwothreeneth HospitalManagementSystem, affecting all versions up to the commit hash 9ef91ed6007314b6473110ed699dff76d158f61d. The vulnerability resides in the 'get' function within the 'edit_accounts.php' file. An attacker can remotely exploit this by manipulating the 'user_id', 'patient_id', 'physician_id', 'discounts_id', or 'services_id' arguments via crafted HTTP GET requests. Because the system follows a rolling release model, there is no specific version number to patch, and the project maintainers have not yet addressed the vulnerability despite early notification. Publicly available exploit code increases the risk of immediate exploitation against internet-facing instances of this software.

Impact

Successful exploitation of CVE-2026-104609 allows an unauthenticated, remote attacker to perform arbitrary SQL commands against the backend database. This may lead to the unauthorized disclosure, modification, or deletion of sensitive patient and administrative healthcare records. Given the nature of hospital management software, the exposure of Personally Identifiable Information (PII) and Protected Health Information (PHI) poses a significant risk to data privacy and regulatory compliance.

Recommendation

• Implement strict input validation and parameterization on all HTTP parameters passed to 'edit_accounts.php' via a Web Application Firewall (WAF) or equivalent reverse proxy.
• Audit database logs for anomalous queries originating from the 'edit_accounts.php' file, specifically looking for SQL syntax characters such as single quotes, double quotes, semicolons, and comment indicators within the requested ID parameters.
• Restrict network access to the 'edit_accounts.php' endpoint to authorized internal network segments only.
• Monitor the official project repository for future commits that introduce secure coding practices or patches addressing this vulnerability.