Database read and write via delid SQLi

SQL injection in viewpaymentreport.php in itsourcecode Hospital Management System 1.0 allows remote authenticated users to read or modify data via delid. The payment-report handler uses the delid request parameter in SQL queries without sanitization, validation, or parameter binding, as shown by the published time-delay proof of concept. Reachability requires a valid application session, so exposure is limited to environments where low-privileged users can access that page, but successful exploitation can alter or disclose database content.