This vulnerability involves an SQL injection in the Online Hospital Management System 1.0 by code-projects. Specifically, the 'editid' parameter in the appointmentdetail.php file's Appointment Handler component can be manipulated remotely to inject SQL commands. The vulnerability is confirmed and publicly disclosed with a CVSS 4.0 base score of 5.3 (medium severity). No official fix or patch has been provided by the vendor, and the affected version is 1.0. The vulnerability allows an attacker with low privileges and no user interaction to potentially impact the confidentiality, integrity, and availability of the system with low complexity.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with a CVSS score of 5.3, indicating limited but meaningful risk to confidentiality, integrity, and availability. There is no evidence of active exploitation in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. Until a patch is released, consider applying application-level input validation or web application firewall (WAF) rules to mitigate SQL injection risks specific to the 'editid' parameter.