The itsourcecode Hospital Management System version 1.0 contains a SQL injection vulnerability in an unspecified function within the /viewprescriptionrecord.php file. The vulnerability arises from improper sanitization of the 'delid' argument, allowing remote attackers with low privileges to inject SQL commands. This can lead to partial compromise of data confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.3, reflecting a medium severity impact with network attack vector, low attack complexity, and no user interaction required. No vendor advisory or patch information is available, and the vulnerability is publicly disclosed with exploit code accessible.

Successful exploitation of this vulnerability can lead to unauthorized manipulation of the database via SQL injection, potentially allowing attackers to read, modify, or delete data. The impact includes partial loss of confidentiality, integrity, and availability of the affected system. However, the attack requires low privileges and no user interaction, making it moderately exploitable remotely. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected functionality and validate or sanitize inputs to the 'delid' parameter to prevent SQL injection. Monitor for updates from the vendor or trusted security sources regarding fixes or mitigations.