This vulnerability affects itsourcecode Hospital Management System version 1.0. An attacker can remotely exploit a SQL injection flaw by manipulating the 'delid' argument in the /viewmedicine.php script. This allows unauthorized SQL commands to be executed on the backend database. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low complexity, no privileges required, and no user interaction needed. Public exploit code is available, increasing the risk of exploitation. No vendor patch or official remediation has been documented yet.

Successful exploitation can lead to unauthorized SQL queries being executed on the system's database, potentially exposing or modifying sensitive data. The vulnerability can be triggered remotely without user interaction or privileges, increasing the attack surface. However, the CVSS score indicates a medium impact level, suggesting limited scope or complexity in exploitation consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and parameterized queries on the 'delid' parameter to mitigate SQL injection risks. Monitoring for unusual database activity related to this parameter may also help detect exploitation attempts.