SourceCodester Hospitals Patient Records Management System 1.0 contains an SQL injection vulnerability in the /classes/Users.php?f=delete endpoint. The vulnerability arises from improper sanitization of the ID parameter, enabling remote attackers to manipulate SQL queries. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and low to limited impacts on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data access, modification, or deletion within the patient records management system. The impact is rated medium due to limited but meaningful confidentiality, integrity, and availability impacts. There is no indication of widespread exploitation in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint, applying web application firewall (WAF) rules to detect and block SQL injection attempts, and reviewing input validation controls. Monitor vendor channels for updates and patches.