A vulnerable parameter in the add-doctor.php page allows an attacker to inject arbitrary SQL statements. This flaw can expose patient records, modify or delete database entries, and potentially compromise the integrity of the entire system. The impact is a direct loss of confidentiality and integrity for sensitive healthcare data.

The vulnerability exists in PHPGurukul Hospital Management System version 4.0; the affected component is add-doctor.php, accessed through the docname parameter. No other products or versions are listed as affected.

The CVSS score of 9.8 marks the flaw as critical, indicating high potential impact. The EPSS score of <1% suggests a low current likelihood of exploitation, and the vulnerability is not yet catalogued in CISA KEV. Based on the description, it is inferred that attackers could exploit the flaw by sending a crafted HTTP request to add-doctor.php, provided they can reach the web application and supply a malicious payload.