A flaw in the Users.php delete function allows an attacker to manipulate the ID argument, resulting in a SQL injection that can be executed remotely. This flaw, classified as CWE-74 and CWE-89, enables unauthorized read or modification of patient records stored in the system.

The vulnerability affects SourceCodester’s Hospitals Patient Records Management System version 1.0. No other affected versions are listed, but any deployment using this version should be considered vulnerable.

The overall CVSS score is 6.9, indicating a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and the public exploit is available, so an attacker could readily target a vulnerable deployment by sending a crafted request to the delete endpoint.