EUVD-2025-210529
GHSA-pwj4-mv8c-c4xg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable injectable parameter with low complexity, but the doctor-portal location implies an authenticated session (PR:L); SQLi yields high C/I/A within a single scope.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1.
AnalysisAI
SQL injection in kishan0725 Hospital Management System 4.0 lets attackers manipulate the 'viewid' parameter of /hms/doctor/view-patient.php to inject arbitrary SQL, exposing and altering the backend patient database. The flaw carries a CVSS 9.8 and CWE-89 classification, and publicly available exploit code exists via a TaintRadar research write-up, though it is not listed in CISA KEV and its EPSS score is only 0.14% (4th percentile). CISA's SSVC framework rates it automatable with total technical impact, meaning successful exploitation can fully compromise database confidentiality, integrity, and availability.
Technical ContextAI
The affected software is kishan0725's Hospital Management System, an open-source PHP/MySQL web application distributed via GitHub for managing patients, doctors, and appointments. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the 'viewid' GET parameter passed to /hms/doctor/view-patient.php is concatenated into a SQL query without parameterization or sanitization, allowing an attacker to break out of the intended query context. Because the application uses classic PHP-with-MySQL query construction, a single injectable integer parameter grants UNION-based or boolean/time-based blind extraction of any table the database user can reach. The CPE data is uninformative here (recorded as cpe:2.3:a:n/a:n/a), so the affected component is identified from the description and reference material rather than a structured NVD product entry.
RemediationAI
No vendor-released patch identified at time of analysis; this is an open-source GitHub project with no fixed version cited in the available data, so operators must self-remediate. The primary fix is to rewrite the query in view-patient.php to use parameterized/prepared statements (PDO or mysqli bound parameters) instead of concatenating the 'viewid' value, and to cast/validate 'viewid' as an integer before use. As interim compensating controls, restrict access to the /hms/doctor/ directory to authenticated staff and known IP ranges (trade-off: breaks remote access for legitimate off-site users), and deploy a WAF rule to block SQL metacharacters on the viewid parameter (trade-off: signature-based filtering can be bypassed and may produce false positives). Monitor the upstream project at github.com/kishan0725 for a patched release and consult the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2025-69942 for updates.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today