The itsourcecode Hospital Management System version 1.0 contains a SQL injection vulnerability in an unspecified function within the /viewdoctorconsultancycharge.php file. This vulnerability arises from improper sanitization of the delid parameter, allowing an attacker to manipulate SQL queries remotely. The vulnerability is identified as CWE-74 and has been publicly disclosed, but there are no known exploits in the wild at this time. The CVSS 3.1 score is 6.3, reflecting a network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation of this vulnerability could allow an attacker with low privileges to perform SQL injection attacks remotely, potentially leading to unauthorized access or modification of data within the Hospital Management System. The impact on confidentiality, integrity, and availability is limited but present. There are no reports of active exploitation in the wild.

No patch or official remediation has been provided or referenced in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict access to the affected endpoint and implement input validation or web application firewall rules to mitigate SQL injection attempts.