The vulnerability CVE-2026-13542 affects itsourcecode Hospital Management System version 1.0. It is caused by improper sanitization of the doctorname argument in /doctorprofile.php, leading to SQL injection. This allows remote attackers to inject malicious SQL commands without requiring user interaction or elevated privileges. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating a network attack vector with low complexity and no user interaction needed. No official fix or patch has been published as of the data provided.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate backend database queries, potentially leading to unauthorized data access, modification, or disruption of the Hospital Management System's database integrity. The attack can be initiated remotely without user interaction, increasing the risk of exploitation. However, the overall impact is rated medium due to limited privileges required and low scope and confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the doctorname parameter in /doctorprofile.php to prevent SQL injection. Monitoring and restricting access to the affected endpoint may reduce exposure. Avoid deploying the affected version 1.0 in production environments if possible.