This vulnerability involves an SQL injection flaw in the 'save' function of the /classes/Users.php file in SourceCodester Hospitals Patient Records Management System 1.0. An attacker can manipulate the ID parameter to inject malicious SQL commands, potentially compromising the database. The vulnerability is remotely exploitable without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector and low complexity. No official fix or patch has been documented in the vendor advisory or related sources.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion within the patient records management system. Given the nature of the affected product, sensitive patient data could be exposed or altered. However, the CVSS vector indicates limited scope and impact, and no confirmed exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation and parameterized queries as temporary mitigations if possible. Monitoring for unusual database activity and restricting access to the affected component may reduce risk. Avoid exposing the vulnerable endpoint to untrusted networks where feasible.