CVE-2025-3304: Patient Record Management System SQLi Flaw

CVE-2025-3304 Overview

CVE-2025-3304 is a SQL injection vulnerability in code-projects Patient Record Management System 1.0. The flaw resides in the /dental_not.php script, where the itr_no parameter is concatenated into a SQL query without proper sanitization. Remote attackers with low-privilege access can manipulate the parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed installations. The vulnerability is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact
Authenticated remote attackers can manipulate the itr_no parameter in /dental_not.php to execute arbitrary SQL queries against the backend database, exposing patient records.

Affected Products

code-projects Patient Record Management System 1.0
CPE: cpe:2.3:a:code-projects:patient_record_management_system:1.0
Component: /dental_not.php (parameter itr_no)

Discovery Timeline

2025-04-05 - CVE-2025-3304 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3304

Vulnerability Analysis

The vulnerability exists in the dental notification handler at /dental_not.php within the Patient Record Management System. The application accepts the itr_no parameter from a HTTP request and embeds it directly into a SQL query string. Because the input is not validated, parameterized, or escaped, an attacker can break out of the intended query context and append arbitrary SQL syntax.

Exploitation requires only low-privilege authenticated access to the application and no user interaction. An attacker with network reach to the web server can issue crafted HTTP requests to read, modify, or delete records stored in the underlying database, including sensitive patient health information.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-74]. The itr_no argument flows from the HTTP request into a dynamically constructed SQL statement without prepared statements or input filtering. Any SQL metacharacters supplied by the attacker are interpreted as query syntax by the database engine.

Attack Vector

The attack vector is remote over the network. An attacker submits a HTTP request to /dental_not.php with a malicious value in itr_no, such as a UNION-based payload or boolean-blind injection string. The injected SQL executes with the privileges of the database account used by the web application, enabling data extraction, authentication bypass, or further compromise of stored procedures.

No verified proof-of-concept code is provided in the public references. Technical details are documented in the GitHub CVE writeup and VulDB entry #303501.

Detection Methods for CVE-2025-3304

Indicators of Compromise

HTTP requests to /dental_not.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the itr_no parameter.
Web server access logs showing unusually long or URL-encoded values for itr_no.
Database error messages returned in HTTP responses referencing syntax errors near the itr_no value.
Unexpected database queries originating from the web application account against patient tables.

Detection Strategies

Inspect web server and application logs for anomalous query strings targeting /dental_not.php.
Deploy a web application firewall (WAF) rule set tuned for SQL injection signatures on the itr_no parameter.
Enable database query logging to identify malformed or unexpected SELECT, UNION, or stacked queries.
Correlate authentication events with subsequent database read spikes from the application service account.

Monitoring Recommendations

Forward web server and database logs to a centralized SIEM for correlation and retention.
Alert on HTTP 500 responses returned from /dental_not.php, which often indicate failed injection attempts.
Monitor outbound data transfer volumes from the database server to detect bulk record exfiltration.

How to Mitigate CVE-2025-3304

Immediate Actions Required

Restrict network exposure of the Patient Record Management System to trusted networks or VPN-only access.
Audit /dental_not.php and related scripts for direct string concatenation of user input into SQL queries.
Rotate database credentials used by the application if exploitation is suspected.
Review database audit logs for unauthorized SELECT statements against patient tables.

Patch Information

No vendor patch has been published in the referenced advisories at the time of NVD listing. Operators should monitor the Code Projects Resource Hub for updates and consider migrating to a maintained patient record platform. Review the VulDB submission #549645 for additional vendor coordination details.

Workarounds

Apply a WAF rule blocking SQL metacharacters and known injection payloads in the itr_no parameter.
Refactor the affected query to use parameterized statements or prepared statements with bound variables.
Enforce input validation requiring itr_no to match an expected numeric format before query execution.
Apply least-privilege controls to the database account so it cannot read or modify tables outside the application scope.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns in itr_no
SecRule ARGS:itr_no "@rx (?i)(union(.*?)select|--|;|/\*|sleep\(|benchmark\()" \
    "id:1003304,phase:2,deny,status:403,msg:'CVE-2025-3304 SQLi attempt on itr_no'"