This vulnerability allows an attacker to perform SQL injection by manipulating the ID argument in the delete function of the /classes/Users.php file in SourceCodester Hospitals Patient Records Management System 1.0. The flaw enables remote exploitation without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector and low complexity. No official fix or patch has been documented, and the vendor has not provided remediation guidance.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion within the patient records management system. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the affected parameter if possible. Monitoring for unusual database activity related to the delete function may help detect exploitation attempts.