This vulnerability in itsourcecode Hospital Management System 1.0 allows remote attackers to perform SQL injection via the 'newpassword' parameter in the /doctorchangepassword.php script. The weakness enables unauthorized manipulation of SQL queries, potentially compromising the database. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low attack complexity, no user interaction, and limited privileges required. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker with low privileges to inject SQL commands remotely, potentially leading to unauthorized data access or modification within the hospital management system's database. The exact impact is limited by the vulnerability's scope and requires further details to assess full consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and monitor for suspicious activity related to the /doctorchangepassword.php script. Avoid exposing this interface to untrusted networks if possible.