This vulnerability affects itsourcecode Hospital Management System 1.0. An attacker can remotely exploit a SQL injection flaw by manipulating the patientid parameter in the /treatmentdetail.php file. The vulnerability allows unauthorized SQL commands to be executed, potentially compromising the database. The CVSS 4.0 base score is 5.3 (medium severity), indicating a network attack vector with low complexity and no user interaction required. No official fix or patch has been published, and the exploit is publicly available.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without user interaction, increasing the risk of attack. However, the CVSS score and vector indicate limited impact due to low confidentiality, integrity, and availability requirements.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. In the meantime, restricting access to the affected endpoint and applying web application firewall rules to detect and block SQL injection attempts may help mitigate risk.