This vulnerability involves SQL injection via the ID argument in the /admin/patients/view_history.php file of SourceCodester Hospitals Patient Records Management System 1.0. An attacker can remotely manipulate this parameter to execute arbitrary SQL queries on the backend database. The CVSS 4.0 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. No official fix or patch has been published, and the product is not a cloud service, so remediation depends on vendor action or user-applied mitigations.

Successful exploitation allows an attacker to execute arbitrary SQL commands on the affected system's database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability consequences. The vulnerability can be exploited remotely without authentication or user interaction, increasing the risk of attack. However, no known exploits in the wild have been confirmed beyond the public exploit release.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should consider applying input validation or parameterized queries as a temporary mitigation if possible. Monitor vendor channels for updates and apply official patches once released. Restrict access to the affected administrative interface to trusted users and networks to reduce exposure.