A weakness in itsourcecode Hospital Management System version 1.0 allows an attacker to inject arbitrary SQL statements through the editid parameter in patientreport.php. The vulnerability corresponds to CWE-74 and CWE-89, reflecting improper input validation and unsanitized SQL concatenation. Successful exploitation could permit reading, modifying, or deleting database records, potentially exposing confidential patient information and compromising data integrity.

The flaw affects Hospital Management System version 1.0 from itsourcecode. The patientreport.php script processes the editid argument without proper validation, and the application is reachable via the internet, exposing the vulnerability to remote attackers.

The CVSS score of 5.3 signifies moderate severity. The EPSS score of less than 1 % indicates a very low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. However, the public availability of an exploit and the remote nature of the attack vector mean that any unpatched instance exposed to external input could still be compromised if an attacker gains access to the vulnerable endpoint.