An unsanitized viewid parameter in the view‐medhistory.php page allows an attacker to inject arbitrary SQL statements, a classic SQL injection flaw (CWE‑89). If exploited, the attacker could read, alter or delete patient medical histories, directly compromising the confidentiality and integrity of sensitive health information.

The only affected product is Hospital Management System 4.0. The vulnerability resides exclusively in the view‑medhistory.php endpoint of this version; no other vendors, products, or versions are implicated.

The EPSS score is below 1 %, the CVSS score is 7.3, indicating a high severity, and the issue is not listed in the CISA KEV catalog. Nonetheless, the potential impact is high: the flaw permits arbitrary data access on protected patient records. The likely attack vector is a direct HTTP request to the vulnerable endpoint with a malicious viewid value, and based on the description it is inferred that no authentication is required, meaning any user with network access could attempt the injection.