This vulnerability affects itsourcecode Hospital Management System version 1.0. An attacker can remotely exploit a SQL injection flaw by manipulating the 'editid' argument in the /servicetype.php file. This allows unauthorized SQL commands to be executed against the backend database. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Public exploit code is available, but there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the database, potentially leading to unauthorized data access or modification. The impact is rated medium based on the CVSS score and the ability to perform remote attacks without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint and monitor for suspicious activity related to the 'editid' parameter. No official remediation or temporary fix has been published by the vendor.