This vulnerability involves SQL injection in SourceCodester Hospitals Patient Records Management System 1.0, specifically in the /classes/Users.php file's 'save' function when processing the 'ID' parameter. An attacker can remotely exploit this by injecting malicious SQL code, potentially leading to unauthorized data access or manipulation. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited impact on confidentiality, integrity, and availability. The vulnerability was published on May 31, 2026, and no official fix or patch has been documented. The exploit code is publicly available, but no active exploitation in the wild has been reported.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized access, data leakage, or data modification within the patient records management system. The impact is rated medium severity based on the CVSS score of 6.9, reflecting limited but significant confidentiality, integrity, and availability impacts. No known active exploitation has been reported, but public availability of the exploit increases risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing application-level input validation and parameterized queries as temporary mitigations to reduce the risk of SQL injection. Monitoring for unusual database activity may also be prudent. No vendor advisory or official patch is currently available.