CVE-2025-56212

The vulnerability results from insufficient validation and sanitization of user input data passed to the docname parameter in the add-doctor.php file. An attacker can inject malicious SQL code directly into the query executed by the database, allowing manipulation of query logic. The attack can be performed remotely without the need to possess any privileges or user interaction.

An attacker can gain unauthorized access to sensitive data stored in the database (including patient and medical staff data), modify or delete records, and under favorable conditions lead to complete loss of system availability.

Patches available from the vendor should be applied in accordance with the references. Additionally, it is recommended to implement parameterized SQL queries (prepared statements) and restrict access to sensitive application files at the web server level.

phpgurukul Hospital Management System version 4.0