This vulnerability affects itsourcecode Hospital Management System version 1.0. An attacker can exploit a SQL injection flaw by manipulating the 'editid' argument in the /treatmentrecord.php file. The vulnerability allows remote exploitation without requiring user interaction or elevated privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. No official fix or patch has been published yet, and no known exploits are reported in the wild despite public disclosure of the exploit.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification within the Hospital Management System. However, the impact is rated medium due to limited privileges required and the absence of confirmed active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and sanitization on the 'editid' parameter and restrict database permissions to limit potential damage from exploitation.