A vulnerability in Hospital Management System 1.0 allows a remote attacker to manipulate the editid parameter in treatmentrecord.php, resulting in an uncontrolled SQL injection. This flaw can enable unauthorized read or modification of database contents, jeopardizing the confidentiality and integrity of patient records. The weakness is consistent with CWE‑74 and CWE‑89 category weaknesses, indicating improper input filtering for database queries.

Itsourcecode Hospital Management System version 1.0 is affected. The problem resides in an unidentified function within treatmentrecord.php, which accepts user input from the editid argument.

The CVSS score is 5.3, indicating a moderate severity. EPSS data is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, where an adversary sends crafted requests to the editid field to inject arbitrary SQL through the web interface.