This vulnerability in code-projects Patient Record Management System 1.0 involves a weakness in the SQL Database Backup File Handler component, specifically in the /db/hcpms.sql file. An attacker can remotely manipulate this component, potentially leading to unauthorized disclosure of information. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity, with attack vector network, low complexity, no privileges required, and user interaction needed. Exploit code is publicly available, increasing the risk of exploitation. No vendor-provided patch or mitigation details are currently known.

Successful exploitation can result in unauthorized disclosure of information from the Patient Record Management System. The vulnerability is remotely exploitable without privileges but requires user interaction. The presence of public exploit code increases the likelihood of attacks. However, there is no indication of privilege escalation, integrity, or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to the affected system and monitor for suspicious activity related to the SQL Database Backup File Handler. Avoid user actions that could trigger the vulnerability if possible. No official vendor mitigation or workaround has been published.