The vulnerability resides in the save_patient_history function of Master.php in SourceCodester Hospitals Patient Records Management System 1.0. By manipulating the ID parameter, an attacker can inject arbitrary SQL into a database query, which is a classic SQL injection flaw classified as CWE‑74 and CWE‑89. Successful exploitation could let the attacker read, modify, or delete patient records and, if the database user has elevated rights, potentially gain wider access to the database.

The affected product is SourceCodester Hospitals Patient Records Management System version 1.0. No other variants or vendors are listed in the CNA data. The vulnerability occurs in a web‑based interface, but the specific server or hosting configuration is not detailed in the CVE.

The flaw carries a CVSS base score of 6.9, indicating moderate severity. The EPSS score is unavailable, so the frequency of real‑world exploitation is unknown. It is not listed in the CISA KEV catalog. The ID argument is accessible via the public web interface, allowing a remote attacker to trigger the injection if the application is vulnerable.