This vulnerability affects itsourcecode Hospital Management System version 1.0. An attacker can remotely exploit an SQL injection flaw by manipulating the patientname argument in the /patientprofile.php file. This allows unauthorized SQL commands to be executed on the backend database. The vulnerability has been publicly disclosed with exploit code available, increasing the risk of attack. No vendor-provided fix or mitigation details have been published as of now.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the database, potentially leading to unauthorized data access or modification. The vulnerability requires no user interaction and can be triggered remotely. The CVSS 4.0 score of 5.3 reflects a medium impact with low complexity and no privileges required, but limited scope and impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected endpoint, applying web application firewall rules to detect and block SQL injection attempts, and monitoring for suspicious activity related to the patientname parameter.