This vulnerability affects code-projects Patient Record Management System 1.0, specifically an unknown function within /edit_hpatient.php that improperly sanitizes the ID parameter. This flaw enables remote attackers to perform SQL injection attacks by manipulating the ID argument, potentially compromising the database. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed with no known exploits in the wild and no vendor-provided patch or mitigation details at this time.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the medium severity score and the requirement of low privileges, but the exact consequences depend on the database and application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint, applying web application firewall rules to detect and block SQL injection attempts, and reviewing application input validation practices for the ID parameter.