What is the CVSS score of CVE-2025-65340?

CVE-2025-65340 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Hospital Management System are affected by CVE-2025-65340?

A critical SQL injection vulnerability (CVSS 9.8) in PHP Hospital Management System 4.0 enables attackers to directly access and manipulate patient and hospital records through the 'fromdate'…

How to fix or mitigate CVE-2025-65340?

Within 24 hours: Conduct an inventory scan to identify all instances of PHP Hospital Management System 4.0 in production environments and isolate exposed endpoints from untrusted networks by restricting access to /betweendates-detailsreports.php. Within 7 days: Implement database-level least-privilege accounts for the application, deploy Web Application Firewall rules to block SQL injection patterns on the 'fromdate' parameter, and enable query logging to detect exploitation attempts. Within 30 days: Replace the system with a vendor-supported healthcare management solution that undergoes regular security assessments, as this open-source project shows no active maintenance.

Hospital Management System CVE-2025-65340

EUVD-2025-210530 CRITICAL

SQL Injection (CWE-89)

2026-07-29 mitre

GHSA-q4xr-8q49-vvhj

PHP SQLi N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-reachable, automatable SQLi (AV:N/AC:L); PR:L rather than PR:N because this admin report endpoint typically requires a login; full DB read/write yields C:H/I:H with limited availability impact (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 21:31 vuln.today

CVSS changed

Jul 30, 2026 - 19:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 29, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 29, 2026 - 00:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php.

AnalysisAI

SQL injection in kishan0725's open-source PHP Hospital Management System 4.0 lets attackers manipulate the backend database via the 'fromdate' parameter of /betweendates-detailsreports.php. Because input is concatenated directly into a SQL query, an attacker can read, alter, or destroy patient and hospital records; publicly available exploit code exists (sqlmap-confirmed injection techniques documented in the TaintRadar research repository). EPSS is low (0.14%, 4th percentile) and there is no CISA KEV listing, so this is a proof-of-concept-stage issue rather than confirmed active exploitation.

Technical ContextAI

The affected component is a PHP web application (Hospital Management System) that generates date-range detail reports. The vulnerability is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), the classic root cause where user-supplied input - here the 'fromdate' request parameter - is interpolated into a SQL statement without parameterization or escaping, allowing the query grammar itself to be altered. The backend is a MySQL/MariaDB database typical of this PHP/LAMP-stack project. The published research shows the flaw is reachable and exploitable through automated tooling (sqlmap), which fingerprints and dumps the database. CPE data is uninformative (cpe:2.3:a:n/a:n/a:*), so exact affected-package identification relies on the vendor project name and description rather than an authoritative NVD CPE.

RemediationAI

No vendor-released patch identified at time of analysis. The definitive fix is to rewrite the vulnerable query in /betweendates-detailsreports.php to use parameterized queries / prepared statements (PDO or mysqli bound parameters) for the 'fromdate' (and any adjacent 'todate') inputs, and to add server-side validation enforcing a strict date format before the value reaches SQL. As interim compensating controls: restrict access to the reporting endpoint to authenticated administrators and place it behind network access controls or a VPN so it is not internet-reachable (trade-off: none for legitimate internal use); deploy a WAF rule to block SQL metacharacters in the fromdate parameter (trade-off: pattern-based WAF rules can be bypassed and may false-positive on legitimate date input); and grant the application's database account least privilege (read-only where possible, no DROP/FILE) to limit blast radius (trade-off: may break report features that write data). Track the project's GitHub repository for an upstream fix and reference the writeup at the TaintRadar URL above.