This vulnerability in SourceCodester Hospitals Patient Records Management System 1.0 allows an unauthenticated remote attacker to perform SQL injection via the ID parameter in /admin/patients/manage_history.php. The injection can lead to partial compromise of data confidentiality and integrity as indicated by the CVSS vector (VC:L, VI:L, VA:L). The vulnerability is rated medium severity with a CVSS 4.0 score of 6.9. No official fix or patch has been published, and the vendor has not provided remediation details. Public exploit disclosure exists but no known active exploitation has been reported.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized access to patient records or modification of data. The impact is limited to partial loss of confidentiality, integrity, and availability as per the CVSS vector. Since the vulnerability is remotely exploitable without authentication, it poses a significant risk to affected systems if left unmitigated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the affected endpoint if possible. Restricting access to the /admin/patients/manage_history.php file and monitoring for suspicious activity may help reduce risk. Avoid exposing the vulnerable system directly to untrusted networks.