This vulnerability affects code-projects Patient Record Management System 1.0. An attacker can remotely exploit a SQL injection flaw by manipulating the ID parameter in the /edit_hpatient.php script. This allows unauthorized SQL commands to be executed against the backend database. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity with network attack vector, low complexity, no user interaction required, and limited impact on confidentiality, integrity, and availability. No official fix or patch has been published as of the vulnerability disclosure date.

Successful exploitation could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access or modification. The impact is limited to the confidentiality, integrity, and availability of the affected system's data, with no indication of system-wide compromise or privilege escalation. The vulnerability can be exploited remotely without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the /edit_hpatient.php endpoint. Review and restrict database permissions associated with the application to minimize potential damage from exploitation.