The vulnerability in HospitalManagementSystem allows an attacker to manipulate the GET parameters user_id, patient_id, physician_id, discounts_id, and services_id in the edit_accounts.php endpoint. Because these identifiers are incorporated into SQL statements without proper sanitization, an attacker can inject arbitrary SQL commands. The CVE notes that the injection is remotely exploitable and that a public exploit is available.

HospitalManagementSystem deployments that use code up to the commit 9ef91ed6007314b6473110ed699dff76d158f61d are affected. As the project follows a rolling release model, all builds earlier than the disclosure date may contain the flaw and no specific rollback points are defined.

The CVSS score of 6.9 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, but the existence of a public exploit and the ability to target the endpoint over the network make the vulnerability a realistic risk for exposed instances.