This vulnerability affects the hospital-management-system-in-php version 1.0 by projectworlds. The getAllPatientDetail function in update_info.php improperly sanitizes the appointment_no GET parameter, enabling remote attackers to inject SQL commands. This can lead to unauthorized database queries or data manipulation. The vulnerability has a CVSS 4.0 score of 6.9, indicating medium severity. The project maintainers have not issued a fix or official remediation, and no patch links are available. Exploit code is publicly known, increasing the risk of attack.

Successful exploitation of this SQL injection vulnerability can allow an attacker to execute arbitrary SQL commands on the backend database. This may result in unauthorized data access, data modification, or disruption of the database operations. Given the nature of the affected software (a hospital management system), sensitive patient data could be at risk. However, there is no evidence of active exploitation in the wild at this time.

No official fix or patch is currently available from the vendor. Users of hospital-management-system-in-php version 1.0 should consider implementing manual input validation or parameterized queries to mitigate the risk. Monitoring for unusual database activity and restricting access to the affected endpoint may reduce exposure. Check the vendor's advisory channels regularly for updates or official patches.