Issues

• SQL Injection in print.php via GET parameter transaction_id

  onetwothreeneth/HospitalManagementSystem#11 · Filter by author ThanatosXingYu opened on Sep 16, 2026

• SQL Injection in transaction_details.php via GET parameter transaction_id (SELECT + UPDATE)

  onetwothreeneth/HospitalManagementSystem#10 · Filter by author hiiragiharudo opened on Sep 15, 2026

• SQL Injection in patient_info.php via GET parameter patient_id - unauthenticated extraction of the admin password

  onetwothreeneth/HospitalManagementSystem#9 · Filter by author ThanatosXingYu opened on Sep 14, 2026

• Unauthenticated SQL Injection in php/controller.php via GET parameter transaction_idS (UPDATE query)

  onetwothreeneth/HospitalManagementSystem#8 · Filter by author ThanatosXingYu opened on Sep 14, 2026

• Missing authorization allows any user (or nobody) to take over the admin account via update_subaccount

  onetwothreeneth/HospitalManagementSystem#7 · Filter by author ThanatosXingYu opened on Sep 14, 2026

• Authentication can be bypassed - the only session check redirects without terminating execution

  onetwothreeneth/HospitalManagementSystem#6 · Filter by author ThanatosXingYu opened on Sep 7, 2026

• Unauthenticated arbitrary file upload leads to Remote Code Execution (webshell)

  onetwothreeneth/HospitalManagementSystem#5 · Filter by author ThanatosXingYu opened on Sep 7, 2026

• SQL Injection in the autofill queries of all record-edit pages via GET id parameters

  onetwothreeneth/HospitalManagementSystem#4 · Filter by author ThanatosXingYu opened on Sep 6, 2026

• LOG IN DETAILS

  onetwothreeneth/HospitalManagementSystem#3 · Filter by author Tookim4 opened on Mar 24, 2020

• Missing models.php file

  onetwothreeneth/HospitalManagementSystem#2 · Filter by author Turing551 opened on May 22, 2018
  4

• Add Patient is not working

  onetwothreeneth/HospitalManagementSystem#1 · Filter by author Turing551 opened on May 22, 2018
  3