The flaw is an unsanitized input vulnerability that allows an attacker to supply a crafted value for the patientid parameter in the /paymentdischarge.php endpoint. Because the value is inserted directly into a database query, an attacker can modify the query logic, potentially reading, updating, or deleting patient records or other database tables. The weakness is a classic SQL Injection (CWE-89) and possibly path-based injection (CWE-74).

Hospital Management System version 1.0 from itsourcecode is affected. The vulnerable code resides in the paymentdischarge.php file and accepts the patientid argument via HTTP request. Network open to remote users can trigger the flaw. No other version or product information is available.

The CVSS base score of 5.3 indicates moderate impact. The EPSS score of less than 1% suggests that exploitation code is rarely circulating. The flaw is not listed in the CISA KEV catalog, so no widespread or state-sponsored exploitation has been reported. However, because remote users can easily send requests that contain malicious patientid values, the risk remains for sites exposing this endpoint.