This vulnerability involves SQL injection in the itsourcecode Hospital Management System 1.0. Specifically, the 'editid' argument in the /department.php file is susceptible to injection attacks, allowing an attacker to manipulate SQL queries remotely. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed, but no official fix or patch has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The medium CVSS score reflects limited impact due to low privileges required and low complexity, but the vulnerability still poses a risk to data integrity and confidentiality within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and sanitization on the 'editid' parameter to mitigate SQL injection risks. Monitor vendor channels for updates or patches addressing this issue.