Which versions of PHP are affected by EUVD-2025-21349?

A critical SQL injection vulnerability in PHPGurukul Hospital Management System 4.0 allows unauthenticated attackers to remotely compromise patient data and system integrity.

Is there a public PoC exploit available for EUVD-2025-21349?

Yes, a public proof-of-concept exploit is available for EUVD-2025-21349. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2025-21349?

Within 24 hours: Isolate affected systems from production networks or restrict access to trusted users only; enable detailed logging on the /user-login.php endpoint. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns in the Username parameter; conduct urgent security assessment of database access logs for signs of compromise. Within 30 days: Evaluate migration to a supported Hospital Management System or implement comprehensive input validation/parameterized queries through custom code patching; coordinate with vendor for patch timeline and interim security updates.

PHP EUVD-2025-21349

Q: What is the CVSS score of EUVD-2025-21349?

EUVD-2025-21349 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2025-7604 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-14 cna@vuldb.com

PHP SQLi Hospital Management System Phpgurukul

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 09:43 euvd

EUVD-2025-21349

Analysis Generated

Mar 16, 2026 - 09:43 vuln.today

PoC Detected

Jul 16, 2025 - 14:32 vuln.today

Public exploit code

CVE Published

Jul 14, 2025 - 13:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /user-login.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

PHPGurukul Hospital Management System 4.0 contains a critical SQL injection vulnerability in the /user-login.php file's Username parameter that allows unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept code available, enabling unauthorized access to sensitive hospital patient data, user credentials, and potential system compromise. With a CVSS score of 7.3 and an attack vector requiring only network access and no authentication, this represents an immediate threat to healthcare organizations running affected versions.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) in a PHP-based hospital management web application. The /user-login.php endpoint fails to properly sanitize or parameterize user-supplied input in the Username parameter before incorporating it into SQL queries. This allows attackers to inject SQL metacharacters and commands that alter query logic. PHPGurukul Hospital Management System 4.0 is a PHP application designed for hospital operations management; the affected version likely uses direct SQL query concatenation rather than prepared statements or parameterized queries. The technology stack involves PHP, likely MySQL or similar relational database backend, and web-based authentication mechanisms.

RemediationAI

Immediate Actions: (1) Patch/Upgrade - Update PHPGurukul Hospital Management System to version 5.0 or later if available; verify patch availability from PHPGurukul official repositories or GitHub; (2) If no patch is available - implement prepared statements with parameterized queries for all database operations in /user-login.php, replacing direct SQL concatenation; (3) Input Validation - Implement strict whitelist validation on the Username parameter (alphanumeric only, maximum length enforcement); (4) Web Application Firewall - Deploy WAF rules blocking common SQL injection payloads (single quotes, SQL keywords like UNION, OR 1=1); (5) Access Controls - Restrict network access to /user-login.php to expected user groups; use reverse proxy authentication; (6) Database Hardening - Apply principle of least privilege to database user accounts used by the application; disable dangerous functions like exec() in PHP; (7) Monitoring - Implement logging and alerting for failed SQL queries and suspicious authentication attempts. Vendor advisory should be checked at PHPGurukul's official channels or GitHub repository for official patch status.