This vulnerability involves SQL injection in the SourceCodester Hospitals Patient Records Management System 1.0, specifically in the /admin/patients/manage_history.php file. An attacker can manipulate the ID parameter to inject SQL code, potentially compromising the database. The vulnerability is remotely exploitable without any privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No vendor-provided patch or mitigation details are available at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to access or modify sensitive patient records stored in the database. Given the nature of the affected system, this could lead to unauthorized disclosure or alteration of protected health information. The vulnerability does not require authentication and can be exploited remotely, increasing the risk. However, the CVSS vector indicates limited confidentiality, integrity, and availability impact, consistent with a medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to the affected endpoint and implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in /admin/patients/manage_history.php. Monitor for any updates from the vendor regarding patches or official mitigations.