# CVE-2026-105383: onetwothreeneth HospitalManagementSystem SQL injection in controller

Source: https://junglewise.ai/threats/cve-2026-105383-a-vulnerability-has-been-found-in-onetwothreeneth  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105383 · Severity: high · CVSS 7.3 · Published 2026-10-05

onetwothreeneth HospitalManagementSystem is a web-based hospital management platform that handles patient records, transactions, and physician information. An unauthenticated attacker can manipulate the transaction_idS parameter to inject SQL commands, allowing them to read sensitive data (patient records, credentials) and modify or delete transaction records without authorization.

Technologies: [Onetwothreeneth HospitalManagementSystem](https://junglewise.ai/threats/technologies/hospitalmanagementsystem). Vendors: [Onetwothreeneth](https://junglewise.ai/threats/vendors/onetwothreeneth).

## Quick answers

**Is CVE-2026-105383 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105383 being exploited in the wild.

**How severe is CVE-2026-105383?** High severity, with a CVSS score of 7.3, published 5 October 2026.

**Which products and versions are affected?** Onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d.

**Is there a fix for CVE-2026-105383?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105383 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105383?** Check whether you run Onetwothreeneth HospitalManagementSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SQL injection vulnerability in php/controller.php (lines 388-397) where the GET parameter transaction_idS is directly interpolated into an UPDATE SQL query without escaping or parameterized queries. The udi() function executes the query via mysqli_query without sanitization, while the application's filters() helper is only applied to $_POST data. Remote unauthenticated attackers can exploit this via time-based blind SQL injection or direct data tampering (OR 1=1 payload) to exfiltrate database contents or mass-modify transaction records.

## Affected products

- onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d

## Timeline

- 2026-09-14: disclosed: Issue #8 opened on GitHub
- 2026-10-05: advisory

## References

- [https://github.com/onetwothreeneth/HospitalManagementSystem/](https://github.com/onetwothreeneth/HospitalManagementSystem/)
- [https://github.com/onetwothreeneth/HospitalManagementSystem/issues/8](https://github.com/onetwothreeneth/HospitalManagementSystem/issues/8)

## Related threats

- [onetwothreeneth HospitalManagementSystem SQL injection in print.php](https://junglewise.ai/threats/cve-2026-105386-a-vulnerability-was-identified-in-onetwothreeneth)
- [onetwothreeneth HospitalManagementSystem SQL injection in transaction_details.php](https://junglewise.ai/threats/cve-2026-105385-a-vulnerability-was-determined-in-onetwothreeneth)
- [onetwothreeneth HospitalManagementSystem authorization bypass in account administration](https://junglewise.ai/threats/cve-2026-105382-a-flaw-has-been-found-in-onetwothreeneth)
- [onetwothreeneth HospitalManagementSystem authentication bypass in sessions handler](https://junglewise.ai/threats/cve-2026-104638-a-security-vulnerability-has-been-detected-in-onetwothreeneth)
- [onetwothreeneth HospitalManagementSystem unrestricted file upload](https://junglewise.ai/threats/cve-2026-104637-a-weakness-has-been-identified-in-onetwothreeneth)