The vulnerability CVE-2026-20000 affects itsourcecode Hospital Management System 1.0. It is caused by improper sanitization of the 'delid' argument in the /viewprescriptionrecord.php file, enabling remote attackers to inject SQL commands. This can lead to unauthorized database queries or modifications. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), with network attack vector, low privileges required, and no user interaction needed. Public exploit code exists, but no official fix or mitigation has been disclosed.

Successful exploitation allows remote attackers to perform SQL injection attacks against the hospital management system database, potentially leading to unauthorized data access or modification. The impact is limited by the low privileges required and low confidentiality, integrity, and availability impacts as per the CVSS vector.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisories for updates. In the meantime, restricting access to the vulnerable functionality and applying web application firewall rules to detect and block SQL injection attempts may reduce risk.