A flaw in itsourcecode Hospital Management System 1.0 allows an attacker to manipulate the delid parameter in vieworder.php, which is incorporated directly into a database query. The vulnerability is a classic SQL injection (CWE‑89) and also involves an unsafe handling of the argument (CWE‑74). Exploitation can read or modify order data, potentially exposing sensitive patient and billing information. The CVSS score of 5.3 classifies it as moderate severity, indicating that successful exploitation would give an attacker significant data access or alteration capabilities.

The vulnerability affects itsourcecode Hospital Management System version 1.0. No other versions were listed as impacted.

The attack vector is remote and doesn’t require authentication; this is inferred because the description does not mention any login requirement, and the exploit works by sending a crafted HTTP request. With EPSS not available and no KEV listing, the likelihood of widespread exploitation cannot be precisely quantified, but the moderate CVSS score suggests moderate risk. An attacker can inject arbitrary SQL by exploiting the unsanitized delid argument, potentially reading or altering order records. Monitoring for anomalous SQL syntax in web logs and restricting access to vieworder.php are recommended mitigations until a patch is applied.