A flaw was discovered in Hospital Management System 1.0 that allows an attacker to manipulate the editid parameter in /doctortimings.php. The application concatenates this value directly into an SQL query without sanitization, enabling an unauthenticated attacker to inject arbitrary SQL commands. Successful exploitation can disclose sensitive data, alter or delete records, and potentially provide escalation path if administrative queries are executed.

Itsourcecode Hospital Management System version 1.0 is affected. No other affected versions are listed in the provided data.

The CVSS score of 5.3 categorizes this as moderate severity. No EPSS score is available, but public discussion and availability of exploits indicate that remote attackers only need to send a crafted HTTP request to trigger the injection. The vulnerability is not listed in the CISA KEV catalog, yet the public nature of the exploit increases the likelihood that it could be used in the wild.