The vulnerability CVE-2026-16009 affects itsourcecode Hospital Management System 1.0. It is a SQL injection issue caused by improper sanitization of the 'delid' parameter in the /prescriptionorderdetail.php file. This flaw allows remote attackers to inject arbitrary SQL commands, potentially compromising the database. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. There is no vendor advisory or patch information available at this time, and the exploit is publicly known.

Successful exploitation of this vulnerability could allow an attacker with low privileges to remotely execute SQL injection attacks via the 'delid' parameter. This may lead to unauthorized data access, modification, or other database-related impacts depending on the backend database and application context. The vulnerability does not require user interaction and has low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or web application firewall (WAF) rules to block malicious payloads targeting the 'delid' parameter. Monitor for updates from the vendor regarding patches or official mitigations.