A SQL injection vulnerability exists in the controller.php file of the onetwothreeneth HospitalManagementSystem. An attacker can manipulate the transaction_idS argument to inject arbitrary SQL code because the application concatenates user input directly into a query without sanitization. This flaw allows remote attackers to read, modify, or delete data stored in the database, potentially compromising confidentiality, integrity, and availability. The weakness is classified as CWE‑74 and CWE‑89 and carries a CVSS score of 6.9, indicating medium severity.

This issue affects all releases of the onetwothreeneth HospitalManagementSystem that include the vulnerable controller.php before the commit 9ef91ed6007314b6473110ed699dff76d158f61d. Since the project follows a rolling‑release model, the exact version numbers are not publicly exposed; any instance running code older than that commit is at risk.

The CVSS score of 6.9 indicates medium severity, and while EPSS data is not available, the public disclosure on multiple platforms and the absence of a corrective release suggest that exploit code may already exist in the wild. The attack vector is remote, carried out over HTTP by sending a crafted transaction_idS parameter. Because the application does not perform input validation or use parameterized queries, attackers with network access can easily trigger the injection.