Description
A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patient_info.php. Performing a manipulation of the argument patient_id results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data Exposure and Integrity Compromise via SQL Injection
Action: Apply Patch
AI Analysis

Impact

An input validation fault in UNION HospitalManagementSystem’s patient_info.php permits a malicious actor to manipulate the patient_id parameter and inject arbitrary SQL statements. The flaw constitutes CWE-74 and CWE-89 vulnerabilities, enabling attackers to read, modify or delete sensitive patient records, thereby compromising confidentiality and integrity of the database.

Affected Systems

The vulnerability exists in the HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d. The project uses a rolling release model, so specific version numbers are not publicly mapped; any release newer than this commit is expected to contain the fix. Remote users can reach the patient_info.php page, presenting a web‑based attack surface.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. EPSS data is not available, yet the vulnerability has been released publicly and is demonstrably exploitable over the network. Because no official patch or vendor response exists, the system remains exposed until an update is applied. The flaw is not listed in CISA KEV, but its remote nature and potential for critical data exposure warrant immediate remediation.

Generated by OpenCVE AI on October 5, 2026 at 19:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the latest HospitalManagementSystem release that includes the fix for the patient_info.php SQL injection flaw.
  • Replace the vulnerable patient_id handling code with a parameterized query or apply strict input validation to eliminate the injection vector.
  • Restrict network access to patient_info.php to trusted administrators and monitor database logs for anomalous queries.

Generated by OpenCVE AI on October 5, 2026 at 19:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 05 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patient_info.php. Performing a manipulation of the argument patient_id results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Title UNION HospitalManagementSystem patient_info.php sql injection
First Time appeared Union
Union hospitalmanagementsystem
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:union:hospitalmanagementsystem:*:*:*:*:*:*:*:*
Vendors & Products Union
Union hospitalmanagementsystem
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Union Hospitalmanagementsystem
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-05T18:39:21.828Z

Reserved: 2026-10-05T10:14:55.204Z

Link: CVE-2026-105384

cve-icon Vulnrichment

Updated: 2026-10-05T18:39:17.793Z

cve-icon NVD

Status : Deferred

Published: 2026-10-05T18:17:35.553

Modified: 2026-10-06T15:04:52.637

Link: CVE-2026-105384

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T20:57:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')