This vulnerability affects itsourcecode Hospital Management System version 1.0. An attacker can remotely exploit a SQL injection flaw by manipulating the 'delid' parameter in the /viewappointment.php file. The vulnerability allows unauthorized SQL commands to be executed due to insufficient input validation or sanitization. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. Although exploit code has been published, no active exploitation has been reported. No vendor-provided patch or remediation information is available at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion within the Hospital Management System database. The impact is rated medium due to limited impact on confidentiality, integrity, and availability as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and sanitization on the 'delid' parameter as a temporary mitigation. Monitor for updates from the vendor regarding patches or official mitigations.