A vulnerability in the Hospital Management System allows an attacker to manipulate the ID argument in admin-panel.php’s Appointment Cancellation handler. Without proper validation, the unescaped value is passed directly to mysqli_query, enabling a classic SQL injection that an attacker can use to read, modify, or delete appointment data in the database. The injection can occur remotely, and public proof‑of‑concept exploits have already been released, indicating that an adversary could compromise the confidentiality and integrity of the medical records stored by the server.

The affected system is the kishan0725 Hospital Management System, specifically the version up to commit 777fda46b77a820977a5ba616283dbfbc40bf7e1. This vulnerability resides in the admin-panel.php file within the Appointment Cancellation handler component. Any deployments of this version that expose the admin panel to external users are at risk.

The CVSS score of 6.9 reflects a medium‑to‑high severity, and the EPSS score is not available, but the vulnerability has already been publicly disclosed and is listed by multiple vulnerability trackers. The attack can be launched remotely by supplying a crafted ID parameter, with no special local privileges required beyond web access. Because the code does not sanitize input and does not use parameterized queries, exploitation is straightforward for a skilled attacker, though no active exploit code was noted in the data. It is not currently listed in the CISA KEV catalog.