EUVD-2025-16905Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in Campcodes Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /user-login.php. The manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Critical SQL injection vulnerability in Campcodes Hospital Management System version 1.0, specifically in the /user-login.php file's Username parameter. This allows unauthenticated remote attackers to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or service disruption. The vulnerability has been publicly disclosed with exploit proof-of-concept available, and poses immediate risk to hospital operations and patient data confidentiality.
Technical ContextAI
The vulnerability exists in a web-based hospital management system written in PHP, specifically in the user authentication module (/user-login.php). The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), which indicates insufficient input validation and sanitization of the Username parameter before incorporation into SQL queries. The application likely constructs dynamic SQL statements by directly concatenating user input without parameterized queries or prepared statements. This is a classic SQL injection flaw where attackers can manipulate SQL syntax to bypass authentication, extract sensitive healthcare data, or modify database records. The affected product is Campcodes Hospital Management System CPE: cpe:2.3:a:campcodes:hospital_management_system:1.0:*:*:*:*:*:*:*
RemediationAI
Primary - Patch: Update Campcodes Hospital Management System to version 1.1 or later (check vendor for availability). Contact vendor at support channels for emergency security patch if version >1.0 unavailable.; priority: Critical - implement within 24-48 hours Code-Level Fix: Replace dynamic SQL concatenation in /user-login.php with parameterized queries/prepared statements. Example (PHP): Use mysqli_prepare() or PDO prepared statements with placeholders (?) instead of string concatenation for Username parameter. Input Validation: Implement strict whitelist validation for Username parameter - alphanumeric and common characters only, enforce length limits (e.g., 50 chars max), reject special SQL characters (', ", ;, --, /*, */) WAF Mitigation (Temporary): Deploy Web Application Firewall (WAF) rules to block requests containing SQL injection patterns in /user-login.php Username parameter (regex: '|--|/\*|\*/|union|select|drop|insert|update|delete|exec|script') Access Control: Restrict network access to /user-login.php to authorized IP ranges only (e.g., hospital intranet, VPN) pending patch availability Monitoring: Enable query logging and monitor for suspicious SQL patterns in application logs; alert on failed authentication attempts with special characters
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today