The flaw resides in an unnamed function of the hematology_print.php file in code-projects Patient Record Management System 1.0. Manipulating the hem_id argument allows an attacker to inject arbitrary SQL statements, enabling unauthorized data extraction, modification or deletion. By executing SQL injection remotely, an adversary can compromise the confidentiality and integrity of the patient records stored in the database.

The vulnerability affects code-projects Patient Record Management System, version 1.0, specifically the hematology_print.php script. The attack vector involves invoking this script with a malicious hem_id parameter, which can be accessed remotely over the web.

With a CVSS score of 5.3, the issue is considered moderate but poses significant risk due to its remote nature and exploit availability. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but published exploits indicate real-world deployment. The lack of official remediation information requires administrators to proactively address the weakness through updates or defensive measures.