This vulnerability in code-projects Patient Record Management System 1.0 involves a weakness in the SQL Database Backup File Handler, specifically in the /db/hcpms.sql file. An attacker can remotely manipulate this component to cause information disclosure. The CVSS 4.0 base score is 5.3, indicating medium severity, with attack vector network, low attack complexity, no privileges required, and no user interaction needed. The vulnerability does not affect confidentiality integrity or availability beyond limited confidentiality impact. No official patch or remediation guidance has been published.

Successful exploitation can lead to unauthorized disclosure of information from the affected system. The impact is limited to confidentiality with no reported effects on integrity or availability. The vulnerability can be exploited remotely without authentication, increasing exposure risk. However, there are no known exploits observed in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently available, organizations should monitor vendor communications for updates. Until a patch is released, restricting remote access to the affected system and limiting exposure of the SQL Database Backup File Handler component may reduce risk.