Which versions of PHP are affected by CVE-2025-6408?

A critical SQL injection vulnerability in Campcodes Online Hospital Management System 1.0 allows remote attackers to exploit the doctor search function, potentially exposing sensitive patient data…

Is there a public PoC exploit available for CVE-2025-6408?

Yes, a public proof-of-concept exploit is available for CVE-2025-6408. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6408?

Within 24 hours: Disable or restrict access to the /doctor/search.php endpoint via firewall rules or WAF if the system is internet-facing; audit logs for suspicious search queries. Within 7 days: Implement input validation and parameterized queries as temporary fixes; assess all affected systems and document inventory. Within 30 days: Migrate to a patched version when released; if unavailable, evaluate replacing Campcodes with a supported alternative; conduct security assessment of the entire application.

PHP CVE-2025-6408

Q: What is the CVSS score of CVE-2025-6408?

CVE-2025-6408 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18890 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-21 cna@vuldb.com

PHP SQLi Online Hospital Management System Campcodes

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 21:35 euvd

EUVD-2025-18890

Analysis Generated

Mar 15, 2026 - 21:35 vuln.today

PoC Detected

Jun 24, 2025 - 18:59 vuln.today

Public exploit code

CVE Published

Jun 21, 2025 - 15:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability has been found in Campcodes Online Hospital Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /doctor/search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

A critical SQL injection vulnerability exists in Campcodes Online Hospital Management System version 1.0 affecting the /doctor/search.php endpoint via the 'searchdata' parameter. An unauthenticated remote attacker can execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the hospital database. Public exploit disclosure and lack of authentication requirements significantly elevate real-world risk.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements used in an SQL Command) in the PHP-based hospital management application. The /doctor/search.php file directly incorporates user-supplied input from the 'searchdata' parameter into SQL queries without proper parameterized statements or input validation. This allows attackers to inject malicious SQL syntax (UNION-based, time-based blind, error-based, or stacked queries) to extract or modify database records. The affected product is Campcodes Online Hospital Management System 1.0, a web-based healthcare administration platform. The vulnerability stems from inadequate use of prepared statements or stored procedures in the search functionality.

RemediationAI

Immediate actions: (1) Implement parameterized queries/prepared statements in /doctor/search.php—replace all dynamic SQL concatenation with parameterized queries using PDO or mysqli prepared statements; (2) Apply strict input validation to the 'searchdata' parameter (whitelist alphanumeric characters and necessary symbols; reject SQL keywords and special characters); (3) Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns (ModSecurity CRS rules, AWS WAF SQL injection signatures); (4) Implement database principle of least privilege—restrict the application database user account to SELECT-only permissions where possible; (5) Enable database query logging and alerts for suspicious activity. Long-term: Contact Campcodes directly to obtain a patched version or consider migrating to a maintained, security-audited hospital management platform. No official patch is currently available; vendor response time is unknown.