This vulnerability affects SourceCodester Hospitals Patient Records Management System 1.0. An SQL injection flaw exists due to improper sanitization of the ID parameter in the save_patient_history function within /classes/Master.php. The vulnerability can be exploited remotely without authentication, potentially allowing attackers to manipulate database queries. The CVSS 4.0 base score is 6.9, indicating medium severity. No official fix or patch has been published as of the data provided.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion within the patient records management system. Given the nature of the affected software, sensitive patient data could be at risk. However, no known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected functionality, applying web application firewalls with SQL injection detection, and monitoring for suspicious activity targeting the save_patient_history function. Avoid exposing the vulnerable endpoint to untrusted networks where possible.