This vulnerability affects code-projects Online Hospital Management System 1.0. An attacker can remotely exploit an SQL injection flaw by manipulating the 'editid' argument in the /patient.php file. The vulnerability allows injection of malicious SQL commands due to insufficient input validation or sanitization. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data disclosure, data modification, or other database-related impacts depending on the database privileges of the application. The CVSS score reflects a medium severity impact with limited confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or web application firewall (WAF) rules to block malicious SQL injection attempts targeting the 'editid' parameter in /patient.php. Monitor for updates from the vendor for an official patch or mitigation.