A SQL injection vulnerability exists in the contact.php file of PHPgurukul Hospital Management System 4.0, where the pagetitle parameter is not properly sanitized. This weakness allows an unauthenticated attacker to inject and execute arbitrary SQL statements, which can lead to disclosure or modification of sensitive data stored in the database. The vulnerability is marked as medium severity, with a CVSS score of 6.5, indicating that it could potentially compromise confidentiality and integrity of the system's data, but it does not provide a direct path to remote code execution.

The affected product is PHPgurukul Hospital Management System version 4.0. No other affected versions or other vendors are specified.

Because the condition depends solely on user-controlled input to contact.php, exploitation can be performed remotely over the web by crafting a request that includes malicious content in the pagetitle field. The EPSS score is less than 1%, suggesting that exploit attempts are currently rare, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the medium CVSS score and the nature of the attack vector indicate that the risk to an organization running this system remains significant, especially if the application is exposed to the Internet.