The Hospital Management System 4.0 contains an SQL Injection flaw in the get_doctor.php script, where the doctor and specilizationid query parameters are not properly sanitized. By supplying crafted input an attacker can manipulate the underlying SQL statement to read, modify or delete records in the database, exposing sensitive patient information and potentially altering business logic.

Any deployment of Hospital Management System version 4.0 is affected. The vulnerability resides in the get_doctor.php endpoint, which accepts doctor and specilizationid parameters without input validation. No vendor or publisher is listed, but the product itself is the target.

The CVSS score of 9.8 classifies this as a critical vulnerability. The EPSS score of less than 1% indicates that the current likelihood of exploitation is very low, and it is not included in the CISA KEV catalog. The likely attack vector is a web-based request to the vulnerable endpoint; the attacker must be able to supply the tainted parameters via HTTP. No authentication requirements are stated, so unprotected access could allow broad exploitation, but if the page is behind authentication an authenticated user could also leverage it. As the description does not mention any mitigations, it is inferred that standard web input handling applies.