A flaw in the /patientorder.php module of itsourcecode Hospital Management System 1.0 allows an attacker to alter the editid parameter, resulting in a classic SQL injection that can execute arbitrary database commands. The weakness is a classic unsanitized user input problem (CWE-74 and CWE-89) that could give an adversary read, modify, or delete data in the underlying database, thereby compromising confidentiality, integrity, and potentially availability of patient records.

The vulnerability exists in the Hospital Management System version 1.0 from itsourcecode. The affected code resides in the patient which processes the editid argument used whenever orders are edited through the web interface.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of < 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The attacker can exploit the flaw remotely to inject SQL commands and manipulate the underlying database.