This vulnerability exists in code-projects Hospital Information System 1.0 within the User Login Handler component. Specifically, the User::login function improperly handles the email parameter, enabling an attacker to inject SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploit code is publicly available, but there is no vendor advisory or official fix published to date.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database via the email parameter in the login function. This could lead to unauthorized data access or modification. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, and no privileges or user interaction are required for exploitation.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a fix is released, consider implementing application-level input validation or web application firewall rules to detect and block SQL injection attempts targeting the login function.