This vulnerability affects the Online Hospital Management System 1.0 by code-projects. It arises from improper control of resource identifiers in the processing of the 'delid' parameter within the viewdoctortimings.php file. An attacker can remotely manipulate this argument to potentially interfere with resource access or operations. The CVSS 4.0 base score is 5.1 (medium severity), indicating a network attack vector with low impact on confidentiality and availability, requiring high privileges but no user interaction. No official fix or patch has been published yet.

The vulnerability allows remote attackers to manipulate resource identifiers via the 'delid' parameter, which could lead to unauthorized actions or data manipulation within the affected system. The impact is rated medium with limited confidentiality and availability impact, and exploitation requires high privileges. No known exploits are currently observed in the wild, but a public exploit is available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, organizations should monitor vendor communications for updates. Until a patch is released, restrict access to the affected functionality and ensure that only trusted, privileged users can interact with the system components handling the 'delid' parameter.