This vulnerability affects code-projects Online Hospital Management System 1.0 and arises from improper control of resource identifiers in the processing of the 'delid' parameter within viewdoctortimings.php. An attacker can remotely manipulate this argument to potentially interfere with resource access or deletion operations. The exploit has been publicly disclosed, increasing the risk of exploitation. No vendor remediation or patch is currently documented.

The vulnerability allows remote attackers to manipulate resource identifiers improperly, which may lead to unauthorized actions related to resource management within the application. The CVSS 4.0 base score is 5.1 (medium), indicating limited but notable impact. There is no evidence of privilege escalation or user interaction required, but the attacker must have high privileges (PR:H) to exploit this issue.

No official patch or remediation guidance is currently available. Users should monitor the vendor's advisories for updates. Until a fix is released, restricting access to the affected functionality and applying compensating controls to limit exposure may help reduce risk.