CVE-2025-3348: Patient Record Management System SQLi Flaw

CVE-2025-3348 Overview

CVE-2025-3348 is a SQL injection vulnerability in code-projects Patient Record Management System 1.0. The flaw resides in the /edit_dpatient.php script, where the ID parameter is incorporated into a database query without proper sanitization. Attackers can exploit the vulnerability remotely over the network with low-privilege authenticated access. The exploit details have been publicly disclosed, increasing the risk of opportunistic abuse against exposed installations.

The issue is tracked under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated attackers can manipulate the ID parameter in /edit_dpatient.php to inject arbitrary SQL, exposing or modifying patient records stored in the application database.

Affected Products

code-projects Patient Record Management System 1.0
CPE: cpe:2.3:a:code-projects:patient_record_management_system:1.0:*:*:*:*:*:*:*
Component: code-projects:patient_record_management_system

Discovery Timeline

2025-04-07 - CVE-2025-3348 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3348

Vulnerability Analysis

The vulnerability is a classic SQL injection in a PHP web application targeting healthcare record management. The affected endpoint, /edit_dpatient.php, accepts an ID parameter that is concatenated directly into a SQL statement used to fetch or update patient records.

Because the application does not use parameterized queries or input validation, attackers can supply crafted values for the ID argument. The injected SQL is executed in the context of the database user backing the application. The attack requires network reachability to the PHP frontend and low-privilege application access.

Public exploit details for CVE-2025-3348 are available, lowering the technical barrier for abuse. The EPSS probability is 0.443% (percentile 35.386 as of 2026-06-29).

Root Cause

The root cause is improper neutralization of user-supplied input before inclusion in a SQL query, consistent with CWE-74. The ID parameter passed to /edit_dpatient.php is trusted by the backend code and forwarded to the database driver without prepared statements, escaping, or type enforcement. Any string the client submits becomes part of the executed query.

Attack Vector

An authenticated user sends an HTTP request to /edit_dpatient.php with a malicious value for the ID parameter. By appending SQL syntax such as boolean conditions, UNION SELECT statements, or stacked queries, the attacker can read arbitrary database tables, modify rows, or enumerate schema information. The attack is remote and does not require user interaction. Refer to the GitHub CVE Documentation and the VulDB entry #303562 for the published proof-of-concept details.

Detection Methods for CVE-2025-3348

Indicators of Compromise

HTTP requests to /edit_dpatient.php containing SQL metacharacters in the ID query parameter (single quotes, --, UNION, SELECT, OR 1=1).
Database error messages or unexpected response sizes returned from the edit_dpatient.php endpoint.
Web server access logs showing repeated parameter tampering against ID from a single client.

Detection Strategies

Deploy a Web Application Firewall (WAF) signature for SQL injection patterns targeting the ID parameter on /edit_dpatient.php.
Enable verbose query logging at the MySQL/MariaDB layer and alert on queries containing comment sequences or UNION constructs originating from the application user.
Correlate authentication events with abnormal request volume to the edit_dpatient.php endpoint to identify abuse by compromised low-privilege accounts.

Monitoring Recommendations

Forward web server, application, and database logs to a centralized analytics platform for SQL injection pattern matching.
Track row-count anomalies on patient tables that may indicate unauthorized SELECT, UPDATE, or DELETE activity.
Alert on outbound data transfers from the application database host that exceed normal baselines.

How to Mitigate CVE-2025-3348

Immediate Actions Required

Restrict network exposure of the Patient Record Management System to trusted networks until a patched build is available.
Audit all calls to /edit_dpatient.php in application code and replace string concatenation with parameterized queries using PDO or mysqli prepared statements.
Rotate database credentials used by the application and reduce the database account to least-privilege permissions.
Review database audit logs for evidence of prior exploitation of the ID parameter.

Patch Information

No official vendor patch is listed in the NVD record at the time of publication. Monitor the code-projects website for updates. Organizations operating Patient Record Management System 1.0 should treat this as an unpatched deployment and apply compensating controls.

Workarounds

Place the application behind a WAF configured to block SQL injection payloads targeting the ID query parameter.
Implement server-side input validation that enforces a numeric type and bounded length on the ID parameter before any database call.
Disable or remove the edit_dpatient.php endpoint if the edit-doctor-patient functionality is not required in the deployment.
Apply database-layer controls such as read-only roles for query paths that do not need write access.

bash

# Example: nginx rule to block non-numeric ID values on the vulnerable endpoint
location = /edit_dpatient.php {
    if ($arg_id !~ "^[0-9]+$") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}