A flaw exists in the 1.0 release of itsourcecode Hospital Management System within the prescriptionorder.php module. The editid parameter is concatenated directly into an SQL statement, enabling a crafted input to introduce arbitrary SQL code. This defect aligns with CWE‑89 (SQL Injection) and CWE‑74 (Improper Handling of Multiple Encodings). Successful exploitation lets an attacker read, modify, or delete records in the backend database, thus compromising data confidentiality and integrity. The issue does not provide a direct denial‑of‑service path but can result in data loss or corruption.

The only documented affected product is itsourcecode Hospital Management System version 1.0. No other versions or vendor‑maintained workarounds are referenced.

The CVSS score of 5.3 places the vulnerability in the medium severity category. The EPSS score is reported as less than 1%, indicating a low probability of exploitation at present. The vulnerability is not listed in CISA's KEV catalog. A remote attacker can trigger the flaw by submitting a crafted request to the prescriptionorder.php endpoint; once successful, arbitrary SQL statements can be executed on the underlying database. Publicly available exploits suggest it could be leveraged in a real attack.