Hospital Management System v4 contains critical SQL injection vulnerabilities that could allow an unauthenticated attacker to compromise backend database integrity.

The application is susceptible to SQL injection via the username1 and password2 parameters in the func3.php script, which does not properly sanitize user input before processing database queries. The vulnerability is accessible to unauthenticated remote attackers.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized data access, modification, or total compromise of the underlying database. Given the CVSS score of 8.8, this flaw represents a High severity risk that could lead to significant data exfiltration or system disruption, directly impacting patient data confidentiality and organizational regulatory compliance.

Immediate Action: Since no official patch is currently identified, administrators should restrict network access to the vulnerable func3.php endpoint.

Proactive Monitoring: Review database query logs for unusual syntax, such as union-based queries or unexpected character patterns, which may indicate active exploitation attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and filter malicious payloads targeting the affected parameters.

Public Exploit Available: Yes, a published proof-of-concept exists in the referenced GitHub Gist.

Given the high severity score and the presence of public technical details, this vulnerability poses a significant risk to the integrity of the hospital management system. Organizations currently running version 4 of this software must prioritize isolating the affected application or applying rigorous input validation filters until a formal vendor-supplied security patch is released.