This vulnerability in onetwothreeneth HospitalManagementSystem allows an attacker to perform SQL injection via the get function in edit_accounts.php by manipulating certain ID parameters. The vulnerability affects all versions up to commit 9ef91ed6007314b6473110ed699dff76d158f61d. Remote exploitation is feasible, and exploit code has been publicly released. The vendor has not provided a patch or response, and due to the rolling release approach, no explicit version numbers are available.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to data disclosure, modification, or deletion. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating significant impact but not critical. The availability of public exploit code increases the risk of attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the affected parameters.