The vulnerability in PHPgurukul Hospital Management System 4.0 allows an attacker to inject arbitrary SQL when the pagetitle parameter is passed to about‑us.php. The flaw can be used to read sensitive patient records, alter data, or delete database entries, thereby compromising confidentiality, integrity, and possibly availability of the hospital’s information system.

PHPGurukul Hospital Management System version 4.0 is affected. No other versions or products are listed as impacted.

The vulnerability scores 8.5 on the CVSS scale, indicating high severity. Its EPSS score is below 1%, suggesting that, at present, exploitation is unlikely, and it is not listed in the CISA KEV catalog. Nonetheless, an attacker could exploit the vulnerability via a web request to about‑us.php, possibly by manipulating the pagetitle query string or POST data, to execute arbitrary SQL commands against the backend database.