A SQL injection flaw in the Appointment Handler component of itsourcecode Hospital Management System 1.0 allows an attacker to manipulate the editid parameter in appointmentdetail.php. This flaw permits the insertion of arbitrary SQL commands, potentially compromising the confidentiality and integrity of patient data stored in the system. The vulnerability is a classic SQL injection (CWE‑74, CWE‑89) and does not inherently cause denial of service, but could lead to data exfiltration or unauthorized database modifications.

The affected product is itsourcecode Hospital Management System, version 1.0. The flaw resides in the file /appointmentdetail.php within the Appointment Handler component. No other versions have been identified as affected in the vendor advisories.

The CVSS score of 5.3 indicates a moderate severity, reflecting the remote nature of the attack but limited impact if the database is properly protected. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not yet widely exploited. The attack can be carried out remotely by supplying a crafted editid value in an HTTP request. Because the exploit is publicly available, the risk rises if the system is exposed to internet traffic.