This vulnerability involves a SQL injection in the save_patient_history function of the SourceCodester Hospitals Patient Records Management System 1.0. The injection occurs through manipulation of the ID parameter in the /classes/Master.php file. The vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands, potentially compromising the integrity and confidentiality of patient records. Although an exploit is publicly available, there is no vendor-provided patch or official fix at this time.

Successful exploitation could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized access, modification, or deletion of patient data. Given the nature of the affected system, this could impact sensitive healthcare information. However, the vulnerability requires no privileges or user interaction, increasing its risk. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the vulnerable parameter. Additionally, review and restrict database permissions to limit the impact of potential exploitation.