This vulnerability affects itsourcecode Hospital Management System 1.0. An attacker can remotely exploit a SQL injection flaw by manipulating the 'editid' argument in the /treatmentrecord.php file. This could allow unauthorized SQL commands to be executed against the backend database. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low complexity, no privileges required, and no user interaction needed. Public exploit code is available, but no official fix or mitigation has been published by the vendor.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without user interaction and requires no privileges, increasing the risk of exploitation. However, the overall impact is rated medium due to limited complexity and scope.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. In the meantime, restricting access to the affected endpoint and employing web application firewalls with SQL injection detection rules may help mitigate exploitation risk.