The vulnerability resides in the Hospital Management System’s Appointment Handler within appointmentapproval.php. This flaw is a CWE‑74—improper neutralization of input during construction of an SQL query—and also aligns with CWE‑89—improper neutralization of special elements used in an SQL command. An attacker can manipulate the editid argument to inject arbitrary SQL statements, which may expose sensitive patient information or alter appointment records, compromising confidentiality and integrity of the system’s data.

itsourcecode Hospital Management System, version 1.0, which is the only affected product listed in the CNA data.

The score of 5.3 on the CVSS scale indicates moderate severity. No EPSS value is available, so the exploitation probability cannot be quantified, but the vulnerability is publicly disclosed and listed as remote. The flaw is not included in CISA’s KEV catalog, which suggests that it is not a widely-used exploit yet. The likely attack vector is over HTTP, where an attacker supplies a malicious editid value to the appointmentapproval.php endpoint to execute the injection. Successful exploitation would allow the attacker to read or manipulate database contents about appointments and potentially other sensitive data handled by the system.