This vulnerability involves an SQL injection in the Patient Record Management System 1.0 by code-projects. Specifically, the hem_id parameter in the /hematology_print.php file is vulnerable to injection attacks, allowing an attacker to manipulate SQL queries remotely. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. Exploit code is publicly available, but no official fix or patch has been disclosed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the database privileges of the application. However, the CVSS score and vector indicate limited impact in terms of confidentiality, integrity, and availability, as the vulnerability has low to limited impact on these aspects.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, organizations should consider implementing web application firewalls or input validation controls to mitigate SQL injection risks related to the hem_id parameter. Monitoring for exploitation attempts is also advisable given the public availability of exploit code.