Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the doc_number parameter at his_admin_view_single_employee.php.
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')