CVE-2025-56214

An attacker submits crafted data in the 'username' parameter of the login form in the index.php file, which is included in the SQL query without proper validation or parameterization. This allows injection of arbitrary SQL instructions directly into the query executed by the database. The attack requires no authentication or user interaction.

An attacker can gain unauthorized access to the database, read, modify or delete sensitive patient and medical staff data, and under favorable conditions take full control of the system or database server.

Apply patches available from the vendor according to references. As interim measures, it is recommended to restrict system access only to trusted networks, implement WAF rules blocking SQL Injection attempts, and replace dynamic SQL queries with parameterized queries (prepared statements).

phpgurukul Hospital Management System version 4.0