The vulnerability resides in the comp_id request parameter of the fecalysis_not.php script of code‑projects Patient Record Management System 1.0. An attacker can inject arbitrary SQL statements by manipulating comp_id, leading to unauthorized read, modification, or deletion of database records. The flaw can be triggered from an external endpoint, making it a remote attacker-accessible vulnerability. The assigned CVSS score of 5.3 reflects the moderate impact on confidentiality and integrity of patient data.

This issue affects the code‑projects Patient Record Management System 1.0. No other versions are listed as vulnerable in the available data. The affected application includes the fecalysis_not.php module, which is part of the standard distribution found on the code‑projects project repository.

The attack vector is remote via HTTP requests, and the EPSS score indicates a low current exploitation probability (<1 %). However, publicly available exploits have been released, so there is an above‑zero risk of compromise. Since the vulnerability is not listed in CISA’s KEV catalog, it may have evaded widespread monitoring, but the potential for data compromise and regulatory breach justifies a prompt response. The most straightforward exploitation path involves crafting a malicious comp_id value and sending it to the vulnerable endpoint from an external network.