A flaw in the /medicine.php script of itsourcecode Hospital Management System allows an attacker to manipulate the editid parameter and inject arbitrary SQL statements against the back‑end database. This vulnerability is a classic injection flaw (CWE‑74) that could lead to disclosure, alteration, or deletion of sensitive data. Because the injected data is executed directly, the attacker can gain unauthorized database access, potentially compromising the entire system.

Itsourcecode Hospital Management System version 1.0 is affected; the vulnerability resides in the medicine.php file that handles the editid query parameter. No other modules have been reported to be at risk.

With a CVSS score of 5.3 the flaw is considered moderate, and an EPSS score of <1% indicates a low probability of exploitation today. The vulnerability is not yet listed in CISA KEV, but a published exploit exists, and the flaw can be triggered remotely via the web interface. The likely attack vector involves sending a crafted HTTP request to /medicine.php with a malicious editid value; however, it is not stated whether authentication or authorization is required to access this endpoint. Based on the description, it is inferred that the attacker would need to reach the medicine.php page to exploit the injection.