This vulnerability affects itsourcecode Hospital Management System version 1.0. An attacker can remotely exploit a SQL injection flaw by manipulating the Date parameter in an unknown function of the /adminaccount.php file. The vulnerability allows unauthorized SQL commands to be executed, potentially compromising the database. The CVSS 4.0 base score is 5.3, indicating medium severity. There is no vendor advisory or patch available at this time.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without user interaction and requires low attack complexity with low privileges. However, the overall impact is limited to low confidentiality, integrity, and availability impact according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /adminaccount.php endpoint and validate or sanitize the Date parameter inputs to mitigate injection risks.