This vulnerability affects itsourcecode Hospital Management System version 1.0. An attacker can remotely exploit a SQL injection flaw by manipulating the 'editid' argument in the /servicetype.php file. The vulnerability allows unauthorized SQL commands to be executed, potentially compromising the backend database. The CVSS 4.0 base score is 5.3 (medium severity), indicating network attack vector, low attack complexity, no user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official remediation or patch is currently documented.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium based on CVSS 5.3, reflecting limited confidentiality, integrity, and availability impact. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and sanitization on the 'editid' parameter to mitigate SQL injection risks. Monitor for vendor updates regarding patches or official mitigations.