This vulnerability affects itsourcecode Hospital Management System version 1.0. An attacker can perform SQL injection by manipulating the 'editid' parameter in the /treatment.php file. This allows remote attackers to potentially execute arbitrary SQL commands on the backend database. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No official patch or remediation guidance is currently available, and the exploit code has been publicly released.

Successful exploitation could allow an attacker with low privileges to execute SQL injection attacks remotely, potentially leading to unauthorized data access or modification. The vulnerability does not require user interaction and has low complexity, but the overall impact is limited by low confidentiality, integrity, and availability requirements as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and sanitization on the 'editid' parameter to mitigate SQL injection risks. Monitor for updates from itsourcecode regarding patches or official mitigations.