The Patient Record Management System version 1.0 from code-projects contains a SQL injection vulnerability in the /hematology_print.php file. Specifically, the hem_id parameter is not properly sanitized, allowing an attacker to inject SQL commands remotely. This vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Although an exploit has been published, there is no vendor-provided patch or official remediation currently available. The vulnerability allows unauthorized manipulation of the backend database via crafted input.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands on the backend database remotely by manipulating the hem_id parameter. This could lead to unauthorized data access, modification, or deletion within the Patient Record Management System database. The CVSS score of 5.3 reflects a moderate impact with low complexity and no required user interaction. There is no indication of known active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the hem_id parameter. Additionally, review and apply input validation and parameterized queries in the affected code if possible. Monitor vendor communications for updates on official patches or mitigations.