The vulnerability resides in Hospital Management System 4.0, where the web page /hms/doctor/view-patient.php accepts an unsanitized viewid query parameter. An attacker can insert malicious SQL payloads that are executed on the backend database, enabling unauthorized data disclosure and modification. The weakness is a classic SQL Injection, identified as CWE‑89, and the high CVSS score of 9.8 reflects the severe impact on confidentiality, integrity, and availability.

Hospital Management System 4.0 is the only product explicitly affected; no vendor or support information is provided beyond the product name.

With a CVSS score of 9.8, the vulnerability is considered critical. The EPSS score is less than 1 %, indicating a very low probability of exploitation in the wild at this time, and the issue is not listed in the CISA KEV catalog. Likely attackers can exploit the flaw remotely by crafting a request to view-patient.php with a malicious viewid value, assuming they can reach the target web server and the database credentials grant sufficient privileges to execute the injected statements.