A flaw in the /medicine.php file of itsourcecode Hospital Management System enables tampering of the editid parameter to perform SQL injection, allowing an attacker to execute arbitrary SQL statements against the back‑end database. This could result in disclosure, alteration, or deletion of sensitive data stored in the system. The vulnerability compromises the application.

Itsourcecode Hospital Management System version 1.0 is affected, with the documented vulnerability residing in the medicine.php file that handles the editid parameter. No other products does not appear to affect components beyond the web interface.

The CVSS score of 5.3 reflects moderate severity, while the EPSS score of < 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV, yet the availability of a published exploit and the fact that it can be triggered remotely through the web layer mean that the risk is real. The likely attack vector is the web interface, with the attacker manipulating the editid query parameter over HTTP or HTTPS, possibly without authentication if access controls are weak.