Clinic Pro contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the month parameter of the monthly_expense_overview endpoint. This weakness, classified as CWE-89, can be exploited using boolean-based blind, time-based blind, or error-based techniques, enabling attackers to extract sensitive database information, potentially exposing confidential patient records and financial data.

The vulnerability affects Softwebinternational’s Clinic Pro product. No specific version numbers are listed in the CNA data, so all deployments that have not applied a vendor patch are considered vulnerable.

The CVSS score of 7.1 places the issue in the high severity range, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attack requires authenticated access, meaning an attacker must first compromise or log into the system, reducing exposure compared to community‑level vulnerabilities.