The itsourcecode Hospital Management System version 1.0 contains a SQL injection vulnerability in the /insertbillingrecord.php file. Specifically, the patientid parameter is susceptible to injection, allowing an attacker to manipulate SQL queries remotely. This vulnerability has been publicly disclosed, but no official fix or patch has been published by the vendor. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no user interaction, and limited confidentiality, integrity, and availability impacts.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database via the patientid parameter. This can lead to unauthorized data access or modification within the Hospital Management System. However, the impact is rated medium due to limited scope and no evidence of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. Until a patch is released, consider restricting access to the affected endpoint and validating or sanitizing inputs at the application level to mitigate injection risks.