Executive brief
The kishan0725 Hospital Management System, a software platform used for managing medical facility operations, contains a security flaw that could allow unauthorized access to its database. By sending specially crafted requests to the doctor lookup feature, an attacker could potentially view, modify, or delete sensitive patient records and administrative data. This could lead to a significant breach of patient privacy and disruption of hospital services.
Technical details
A SQL injection vulnerability exists in kishan0725 Hospital Management System 4.0 within the 'get_doctor.php' component. The application fails to properly sanitize user-supplied input provided through the 'doctor' and 'specilizationid' parameters before using them in database queries. A remote attacker can exploit this by sending malicious SQL commands to the server, potentially leading to unauthorized data extraction, modification, or full database compromise. The vulnerability was identified via TaintRadar and affects the core doctor lookup functionality.
Affected products
- kishan0725 Hospital Management System 4.0
Timeline
- 2026-07-29: disclosed: Initial NVD publication date
References
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-get_doctor.php-doctor-sqli/20250811-hospital-management-system-get_doctor.php-doctor-sqli.md
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-get_doctor.php-specilizationid-sqli/20250811-hospital-management-system-get_doctor.php-specilizationid-sqli.md