An SQL injection vulnerability exists in the /edit_hpatient.php file of code-projects Patient Record Management System 1.0, where the ID argument is not properly validated. The flaw permits an attacker to inject arbitrary SQL through the ID parameter and manipulate database queries. The impact is the unauthorized disclosure of patient records, modification or deletion of sensitive data, and potential escalation to broader system compromise due to the nature of database access.

The affected software is code-projects Patient Record Management System version 1.0, deployed by organizations that host the application. No other vendors or product versions are listed as impacted.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is exploitable remotely as the attack can be initiated from outside the network. The EPSS score is not available and the issue is not in the CISA KEV catalog, but the fact that the exploit has been publicly disclosed means that threat actors could target vulnerable installations. An attacker who can craft requests to edit_hpatient.php with a malicious ID value can gain unauthorized read/write access to the underlying database.