The vulnerability is a classic SQL injection flaw in the Hospital Management System 4.0 web application, specifically in the check_availability.php script. The flaw allows an attacker to inject arbitrary SQL through the emailid and email parameters, which can lead to unauthorized reading, modification, or destruction of database records. This is a CWE-89 weakness, meaning the application fails to properly sanitize or parameterize user input, providing a pathway for data compromise and possible alteration of patient records.

Hospital Management System 4.0, a web-based patient information platform. The affected component is the check_availability.php page that processes emailid and email query parameters. No specific vendor or patch release information is present in the CVE entry; the vulnerability applies to the 4.0 release of the product as distributed by the original developers.

The CVSS score of 7.3 categorizes this as a high-severity flaw, indicating substantial impact if exploited. The EPSS score of less than 1% suggests that, at the time of this analysis, exploitation probability is low, although the web-accessible nature of the script could allow remote attackers to trigger the injection. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation yet. Attackers would likely target the application via crafted HTTP requests to check_availability.php, potentially leveraging simple form inputs or URL manipulation to inject malicious SQL.