This vulnerability affects itsourcecode Hospital Management System version 1.0. An attacker can remotely exploit a SQL injection flaw by manipulating the 'delid' argument in the /viewpaymentreport.php script. This allows unauthorized SQL commands to be executed on the backend database. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. Public exploit code exists, but no vendor patch or fix has been published yet.

Successful exploitation could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium based on the CVSS score and vector, indicating limited but significant risk to confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable script, applying web application firewall rules to detect and block SQL injection attempts, and monitoring for suspicious activity related to the 'delid' parameter.