SQL Injection Vulnerability in onetwothreeneth HospitalManagementSystem
CVE-2026-104609

6.9MEDIUM

Key Information:

Vendor: Onetwothreeneth
Status: Hospitalmanagementsystem
Vendor: CVE Published:; 2 October 2026

🔔 Create Onetwothreeneth Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-104609?

A critical security weakness has been detected in the onetwothreeneth HospitalManagementSystem affecting the edit_accounts.php file's get function. This flaw occurs due to improper handling of query parameters such as user_id, patient_id, physician_id, discounts_id, and services_id, which allows an attacker to perform SQL injection attacks. This opens the door for remote exploitation, potentially compromising sensitive healthcare and user information. Despite an early report to the project maintainers, no remedial action has been communicated to the public. Given the nature of their rolling release approach, users are urged to exercise caution while using affected versions.

Affected Version(s)

HospitalManagementSystem 9ef91ed6007314b6473110ed699dff76d158f61d

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-104609 - Proof of Concept