This vulnerability involves improper sanitization of the 'ID' parameter in the save_patient function of the Master.php file in SourceCodester Hospitals Patient Records Management System 1.0. An attacker can remotely inject SQL code via this parameter, potentially manipulating the backend database. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. No vendor patch or official remediation level is currently documented.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with low to low impact on confidentiality, integrity, and availability according to the CVSS 4.0 vector. There are no confirmed exploitations in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint and employ web application firewall rules to detect and block SQL injection attempts targeting the 'ID' parameter. Monitor for updates from SourceCodester regarding patches or official mitigations.