What is the CVSS score of CVE-2025-5603?

CVE-2025-5603 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-5603?

A critical SQL injection vulnerability in Campcodes Hospital Management System 1.0 allows remote attackers to compromise patient data and system integrity through the registration form.

Is there a public PoC exploit available for CVE-2025-5603?

Yes, a public proof-of-concept exploit is available for CVE-2025-5603. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5603?

Within 24 hours: Isolate affected systems from production networks or restrict access to registration.php to trusted networks only; alert security team and business continuity leadership. Within 7 days: Deploy WAF rules to block SQL injection patterns in full_name and username parameters; conduct audit of registration logs for exploitation attempts and data exfiltration. Within 30 days: Plan immediate upgrade or replacement of Campcodes HMS; if upgrade unavailable, implement input validation/parameterized queries at application layer; conduct full security assessment of patient data integrity.

PHP CVE-2025-5603

EUVD-2025-16903 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-04 cna@vuldb.com

PHP SQLi Online Hospital Management System Campcodes

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:29 euvd

EUVD-2025-16903

Analysis Generated

Mar 14, 2026 - 17:29 vuln.today

PoC Detected

Jun 10, 2025 - 15:09 vuln.today

Public exploit code

CVE Published

Jun 04, 2025 - 18:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability has been found in Campcodes Hospital Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /registration.php. The manipulation of the argument full_name/username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical SQL injection vulnerability in Campcodes Hospital Management System version 1.0, affecting the /registration.php endpoint's full_name and username parameters. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of sensitive healthcare information. The vulnerability has been publicly disclosed with proof-of-concept code available, and exploitation requires no special privileges or user interaction.

Technical ContextAI

The vulnerability stems from improper input validation and parameterized query failures in PHP code handling user registration data. The affected component (/registration.php) fails to sanitize user-supplied input in the full_name and username parameters before incorporating them into SQL queries, directly violating CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The root cause is the absence of prepared statements or proper escaping mechanisms. CPE: cpe:2.3:a:campcodes:hospital_management_system:1.0:*:*:*:*:*:*:* indicates the specific affected product and version. This is a classic second-order injection scenario where user input flows directly from the HTTP request into database query construction without intermediate sanitization.