A flaw in the hospital management system allows attackers to inject malicious SQL through the deptid parameter in the departmentDoctor.php file. This vulnerability is a classic SQL injection that can be exploited remotely, potentially exposing, modifying, or deleting sensitive database records. The associated weaknesses are identified by CWE‑74 and CWE‑89, indicating a failure to properly sanitize input before incorporating it into SQL statements.

The affected product is itsourcecode Hospital Management System version 1.0. The flaw resides in the departmentDoctor.php module and applies to this release only.

The vulnerability has a CVSS score of 5.3, reflecting moderate severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Attackers can trigger the injection remotely by sending crafted requests containing malicious deptid values. Even without explicit authentication requirements in the description, remote input exposure means that any user can attempt the attack, increasing the likelihood of exploitation.