An attacker can abuse a flaw in the Hospital‑Management‑System 1.0 search.php file by supplying a malicious Contact value that is not properly escaped. This allows arbitrary SQL statements to be executed against the application's database, exposing, modifying or deleting data. The vulnerability is a classic example of a CWE‑74 based input‑validation bypass compounded by a CWE‑89 data‑access issue.

The flaw specifically targets the Hospital‑Management‑System developed by kishan0725, version 1.0. The affected component is the search.php endpoint, whose code processes the Contact parameter without adequate sanitisation.

The CVSS score of 6.9 classifies the issue as a moderate risk with some impact on confidentiality, integrity and availability. The public disclosure and the fact that the exploit code has been released indicate that an attacker can launch an attack via a normal HTTP request to the vulnerable endpoint. Although the EPSS score is unavailable, the lack of a KEV listing does not negate the risk; the flaw remains usable for unauthenticated external attackers.