Database disclosure and modification via password2 injection

SQL injection in Hospital Management System 4 allows remote attackers to read or alter database data through the password2 login parameter. The patient-login branch in func.php inserts password2 directly between quotes in a SELECT statement and submits the resulting string to mysqli_query without parameter binding or escaping. No authentication or user interaction is required; the published time-delay payload targets query execution, and the reported impact is limited to database confidentiality and integrity.