Hospital Management System 4.0 contains a SQL Injection flaw in the /doctor/edit-patient.php page when the editid query parameter is used. The flaw allows an attacker who can send crafted input to the editid parameter to influence the SQL statements executed against the database. Because the affected code directly interpolates the value into a query, it is inferred that an attacker can potentially read, modify, or delete patient records, thereby compromising patient confidentiality and data integrity. The weakness is identified as CWE‑89 and the CVSS score reflects a high impact on data exposure.

The vulnerability affects the Hospital Management System 4.0 web application. No additional version details are provided beyond the major release, and the vendor name is not specified. The affected page is reachable through the /doctor/edit-patient.php endpoint, implying that any user who can access that page – possibly a logged‑in doctor – is at risk unless mitigated.

The CVSS score of 7.3 indicates a medium‑to‑high severity, and the EPSS probability is reported as less than 1%, showing that widespread exploitation is unlikely but not impossible. The flaw is listed as not in the CISA KEV catalog. The likely attack vector is remote over the web, where an attacker crafts a malicious value for the editid query string. Based on the description, it is inferred that the endpoint may be accessible to authenticated users such as doctors, making the attack feasible for an insider or compromised account.