A SQL injection flaw exists in the getSinglePresp function of the Hospital Information System’s PrespController.php file. By manipulating the ID argument, an attacker can inject arbitrary SQL statements into the query that retrieves a single prescription record. This weakness is classified as CWE-74 and CWE-89. The vulnerability allows an attacker to retrieve, modify, or delete sensitive prescription data, potentially exposing patient information and the underlying database.

The vulnerability affects only code-projects Hospital Information System version 1.0. No other versions or products were listed in the advisory.

The CVSS score of 6.9 indicates a medium severity impact. The attacker must be able to send requests containing a crafted ID value. While no EPSS score is currently available and the issue is not listed in the CISA KEV catalog, the public release of an exploit suggests that remote attacks are feasible. The breach could lead to data disclosure or alteration of prescription records, impacting confidentiality and integrity of patient data.