A bug in the Hospital Information System 1.0 function viewReq.php allows attackers to tamper with the ID parameter. The vulnerability is a classic SQL Injection (CWE-74 and CWE-89) that permits arbitrary SQL commands to be executed against the underlying database. Because the payload is delivered via a standard web request, the exploit can be executed from any network that can reach the application, and publicly available exploits already exist.

The flaw exists in version 1.0 of code-projects Hospital Information System. No other versions were identified as impacted, and the CVE provides no additional circumvention of the defect. Administrators should verify that only the affected version is running, and identify any deployments of this open-source application.

The CVSS score of 6.9 indicates a medium severity vulnerability. Although the EPSS score is not available, the existence of a publicly available exploit and the remote nature of the vector suggest that the probability of real-world exploitation is non-negligible. The vulnerability is not currently listed in the CISA KEV catalog, but its availability on public bug trackers signals that it could be actively used. Attackers can inject malicious SQL through the ID field, potentially reading sensitive patient records, modifying or deleting data, and escalating privileges if the database credentials are strong admin access.