A flaw in the /patient.php page of code‐projects Online Hospital Management System allows an attacker to alter the editid parameter, resulting in an SQL injection vulnerability. This flaw permits the execution of arbitrary SQL statements against the underlying database, potentially exposing patient records or modifying data. The affected functionality is accessible remotely through the web interface.

The vulnerability exists in code-projects Online Hospital Management System version 1.0. Any deployment of this system that has not applied a patch or updated to a fixed version is vulnerable, as the attack vector targets the publicly accessible patient.php endpoint.

The CVSS score of 6.9 indicates medium severity, and the vulnerability is exploitable remotely via the web interface. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog, suggesting a moderate but non‑negligible likelihood of exploitation. An attacker can gain unauthorized data access or alter patient records without additional privileges, leveraging the weakness for potential further attacks such as credential compromise or denial of service.