The itsourcecode Hospital Management System version 1.0 contains a SQL injection vulnerability in an unspecified function within /payment.php. The vulnerability arises from improper sanitization of the patientid argument, allowing an attacker to inject SQL code remotely. The CVSS 4.0 base score is 5.3 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. No official fix or vendor advisory is provided at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database via the patientid parameter. This may lead to unauthorized data access or modification within the Hospital Management System. The impact is rated medium based on the CVSS score and the limited scope of the vulnerability as described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint and applying web application firewall rules to detect and block SQL injection attempts targeting the patientid parameter.