This vulnerability affects code-projects Online Hospital Management System version 1.0. It arises from insufficient input validation in the /viewappointment.php script, specifically the 'delid' argument, which can be manipulated to inject SQL commands. The vulnerability is remotely exploitable without authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. No official remediation or patch has been published by the vendor as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity, reflecting limited but meaningful risk to confidentiality, integrity, and availability. No active exploitation in the wild has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or web application firewall rules to block malicious SQL injection payloads targeting the 'delid' parameter. Monitor for vendor updates regarding patches or official mitigations.