The flaw lies in the SQL Database Backup File Handler of the hospital information system. An unknown functionality of the exposed file /HIS/his.sql can be manipulated to reveal its contents, allowing remote attackers to gain access to confidential data. This vulnerability is classified as CWE‑200 and CWE‑284 and enables remote information disclosure.

The vulnerability targets the 1.0 release of the code‑projects Hospital Information System, specifically the component that serves the SQL database backup file. No other versions are listed, so all installations running this version are susceptible to exploitation.

The CVSS score of 6.9 signals a moderate severity, but the existence of a publicly available exploit makes the threat more pressing, especially since the vulnerability can be triggered remotely via direct file access. Although the EPSS score is not available and the issue is not in the CISA KEV catalog, the fact that an attacker can read sensitive backup data requires immediate attention by administrators.