This vulnerability exists in code-projects Hospital Information System 1.0 within the User Login Handler component. Specifically, the User::login function improperly sanitizes the email parameter, enabling remote attackers to inject SQL commands. The flaw allows unauthorized database queries through crafted input. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality, integrity, and availability impact. Exploit code is publicly available, increasing risk of exploitation.

Successful exploitation can lead to unauthorized SQL queries on the backend database, potentially exposing or manipulating sensitive data. The impact is rated medium severity with limited confidentiality, integrity, and availability impact as per CVSS 4.0 metrics. No confirmed active exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to implement input validation and parameterized queries for the email parameter in the User::login function to mitigate SQL injection risk.