This vulnerability exists in the login_user function of the login_1.php file in code-projects Online Hospital Management System version 1.php. It allows an unauthenticated remote attacker to perform SQL injection by manipulating the Username parameter. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and partial impact on confidentiality, integrity, and availability. The vulnerability is documented as published with an exploit available, but no vendor patch or fix has been confirmed.

Successful exploitation can lead to unauthorized SQL queries being executed on the backend database, potentially exposing or modifying sensitive data related to user authentication. This could compromise the confidentiality and integrity of the system's data. The attack can be performed remotely without authentication or user interaction, increasing the risk of exploitation. However, the impact is rated medium due to partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries to mitigate SQL injection risks in the affected login_1.php file. Monitor for updates from the vendor regarding patches or official mitigations.