The Hospital Management System of phpGurukul version 4.0 contains an unfiltered username parameter in index.php that is directly incorporated into an SQL statement. This flaw qualifies as a SQL Injection vulnerability (CWE-89) and allows an attacker to execute arbitrary SQL commands. The consequence can include reading, modifying, or deleting confidential patient data and undermining the integrity of the medical records database.

The affected product is the phpGurukul Hospital Management System, specifically version 4.0. No other products or versions are mentioned in the CVE data.

The CVSS score of 9.8 marks this flaw as critical. The EPSS score is less than 1%, indicating a low likelihood of exploitation at present. This vulnerability is not listed in the CISA KEV catalog. Although the attack vector is inferred to be remote via the web interface, no specific exploit has been documented. The absence of an official patch or workaround places the responsibility on administrators to mitigate the risk themselves.