This vulnerability in itsourcecode Hospital Management System 1.0 involves an SQL injection flaw in the /prescriptionrecord.php file. Specifically, the 'delid' argument is susceptible to injection, enabling remote attackers to manipulate SQL queries. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. The CVSS 4.0 vector indicates low confidentiality, integrity, and availability impact. No vendor remediation or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated as medium severity with limited confidentiality, integrity, and availability impact according to the CVSS 4.0 vector. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint and validate or sanitize inputs to the 'delid' parameter to mitigate injection risks.