The headline metrics for this SQL injection in itsourcecode Hospital Management System create a prioritization puzzle worth unpacking. CVSS 6.3 with a public exploit should drive urgency. An EPSS of 0.00333 suggests automated exploitation infrastructure is unlikely to sweep this target. The gap is not a contradiction to resolve — it is the actual signal.
EPSS models mass-scanner behavior, exploit-kit activity, and commodity malware. These systems have learned that unknown PHP demo projects on healthcare perimeters don't appear in their sweeps, so they've collectively deprioritized this target class. That telemetry is accurate — but it documents automated attacker behavior, not targeted attacker behavior. A determined actor running recon against a hospital's perimeter doesn't need a scanner to find viewservicetype.php. A Shodan query or DNS enumeration surfaces it. Once the exploit is public, EPSS becomes irrelevant to them.
Healthcare organizations are disproportionately victimized by targeted campaigns precisely because patient data has sustained black-market value. The assumption that 'nobody would target a demo' works until someone does — exactly once.
The application's origin as a free demo platform changes the remediation calculus. There may be no vendor patch — these projects don't have security teams or patch pipelines. The remediation question isn't 'when does the vendor release a fix,' it's 'does this application get patched at all, or does it get quietly sunsetted when the next demo version drops?' For demo applications in healthcare contexts, 'replace it with something maintained' is often the correct security control — not 'apply the update.'
The detonation radius matters more than the CVSS score. This viewservicetype.php is almost certainly connected to a backend holding patient records, appointment data, possibly insurance information. SQL injection gives you the database, and healthcare networks are notoriously flat — meaning that foothold becomes a pivot point to adjacent clinical systems. A 6.3 with public exploit in a flat healthcare network with patient data downstream is not a low-priority finding because EPSS says so. It's a targeted threat with extended exposure windows precisely because these installations often exist in maintenance abandonment, unknown to asset inventory, unmonitored in SIEM.
Check your perimeter for unknown itsourcecode or similar demo PHP applications. If found, the priority question is not 'how fast can we patch' — it's 'should this system exist on our network at all.'