The vulnerability resides in adminaccount.php of itsourcecode Hospital Management System v1.0. An attacker can manipulate the Date argument to inject arbitrary SQL statements. This flaw enables unauthorized reading or alteration of database contents, potentially exposing sensitive patient data, but it does not grant the attacker the ability to execute arbitrary code or gain system-level privileges.

Affected product is itsourcecode Hospital Management System, version 1.0. The flaw lies in the adminaccount.php script handled by the web interface. Only installations with the unpatched 1.0 release are vulnerable; later versions are unknown to be patched.

The CVSS score of 5.3 marks this flaw as moderate severity. EPSS information is unavailable and the flaw is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. The attack can be launched remotely via the exposed adminaccount.php URL, requiring no user interaction beyond supplying a crafted Date parameter. An attacker with network access to the web server could exploit this vulnerability to read or modify data stored in the system’s database.