The vulnerability is an unauthenticated SQL injection flaw in the /viewmedicine.php page of itsourcecode Hospital Management System 1.0. By manipulating the delid parameter, an attacker can cause the application to execute arbitrary SQL statements, potentially enabling unauthorized viewing, alteration, or deletion of sensitive medical records and compromising both confidentiality and integrity.

The affected product is itsourcecode Hospital Management System 1.0, specifically the viewmedicine.php script that processes the delid argument. No other product versions are listed, so the flaw applies to deployments of the 1.0 release that have not been updated with the vendor's fix.

The CVSS score of 5.3 indicates moderate severity, and the lack of an EPSS rating or KEV listing suggests limited observed exploitation. Nevertheless, the bug can be triggered remotely by sending a crafted HTTP request with a malicious delid value, as attackers can bypass input validation (CWE-74) to inject arbitrary SQL. Because the public exploit code is available, prompt remediation is advised.