This vulnerability affects itsourcecode Hospital Management System version 1.0. An attacker can perform SQL injection by manipulating the 'editid' parameter in the /treatment.php file. The vulnerability allows remote attackers to execute unauthorized SQL commands. The CVSS 4.0 base score is 5.3, indicating medium severity. No official patch or remediation guidance is currently available, and the exploit code is publicly known.

Successful exploitation could allow an attacker with low privileges to execute SQL injection attacks remotely, potentially leading to unauthorized data access or modification. The vulnerability has a medium impact rating based on CVSS 4.0 with low complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected functionality and monitor for suspicious activity related to the 'editid' parameter. Consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting this parameter.