The itsourcecode Hospital Management System version 1.0 contains a SQL injection vulnerability in the /adminprofile.php file. Specifically, the loginid parameter is not properly sanitized, enabling remote attackers to inject SQL commands. This vulnerability has been publicly disclosed, increasing the risk of exploitation. The CVSS 4.0 base score is 5.1, indicating medium severity. No official fix or patch has been published by the vendor as of the information provided.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access, modification, or disruption of the hospital management system's database integrity. However, the impact is limited by the requirement of high privileges and the vulnerability having low to limited scope and impact metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /adminprofile.php functionality to trusted users only and monitor for suspicious activity related to the loginid parameter. Avoid exposing the vulnerable interface to untrusted networks where possible.