The PHPGurukul Hospital Management System 4.0 contains a flaw in an unreferenced function within manage-doctors.php that allows an attacker to manipulate the ID parameter and perform SQL injection. This vulnerability can enable unauthorized data extraction or modification in the underlying database. The flaw is a typical SQL injection weakness, listed as CWE‑89 and CWE‑74, and can compromise the confidentiality and integrity of patient records and administrative data.

The affected vendor is PHPGurukul, specifically version 4.0 of the Hospital Management System. No alternative products are listed, and the vulnerability applies to all installations that expose the /hms/admin/manage-doctors.php endpoint without additional access controls.

The CVSS score of 5.1 indicates a moderate severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not in the CISA KEV catalog, implying no known widespread exploitation at present. The most likely attack vector is remote, as the description states the attack may be performed from outside the internal network. An attacker would need network reach to the web application, but once accessed could inject arbitrary SQL through the ID parameter, potentially exfiltrating sensitive data or altering database contents.