The flaw allows unauthenticated remote callers to inject arbitrary SQL into the editid parameter used by department.php. By manipulating this argument, an attacker can read, modify, or delete data in the hospital’s database. The vulnerability is classified as a classic SQL injection (CWE-74 and CWE-89).

itsourcecode Hospital Management System version 1.0, specifically the department.php script. No later versions were identified; the vulnerability appears in the default installation.

The CVSS score of 5.3 indicates a moderate severity. Because the EPSS score is not available and the vulnerability is not yet listed in the CISA KEV catalog, the likelihood of exploitation is uncertain; however, the public exploit code with the ability to perform remote attacks suggests that attackers could target exposed installations. Attackers would need network reachability to the web interface; no authentication is mentioned, implying the flaw is exploitable from any remote host.