This vulnerability involves an SQL injection in the itsourcecode Hospital Management System 1.0, specifically in an unknown function within /prescription.php. By manipulating the 'editid' argument, an attacker can inject SQL commands remotely. The vulnerability has been publicly disclosed with an exploit available, but no vendor fix or mitigation has been provided yet. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. However, the impact on confidentiality, integrity, and availability is rated as low according to the CVSS vector. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'editid' parameter.