The Hospital Information System developed by code‑projects contains an unprotected parameter called Search in the findBySearch function of addReq.php. When the Search argument is sent to the backend without any validation or parameterization, a malicious user can inject arbitrary SQL statements. The injected query can read, modify, or delete any data stored in the database, thereby compromising the confidentiality and integrity of patient records.

The affected product is code‑projects Hospital Information System version 1.0. This vulnerability is confined to the 1.0 release and is reported only for the addReq.php component.

The CVSS score of 6.9 denotes moderate severity. The EPSS score is not available, leaving the current probability of exploitation unclear, yet the vulnerability is publicly disclosed and can be triggered remotely via the Search endpoint. It is not listed in CISA’s KEV but remains a viable threat because attackers can use generic SQL injection techniques.