The vulnerability resides in the getAllPatientDetail function within update_info.php of the Hospital Management System in PHP. By manipulating the GET parameter appointment_no, an attacker can inject arbitrary SQL code. This SQL injection allows unauthorized reading or modification of the underlying database, potentially leaking sensitive patient information or altering records. The weakness is reflected by CWE-74 for misuse of GET parameters and CWE-89 for SQL injection.

Projectworlds Hospital Management System in PHP version 1.0 is affected. No other versions or extensions are listed as vulnerable.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but a published exploit demonstrates that it is already in the wild. The attack vector is remote, meaning any user with network access can attempt exploitation by supplying a crafted GET request to the update_info.php endpoint. An attacker who succeeds can read or modify patient records, compromising confidentiality and integrity across the system.