CVE-2025-41004: Patient Records Management System SQLi

CVE-2025-41004 Overview

CVE-2025-41004 is a SQL Injection vulnerability [CWE-89] affecting Imaster's Patient Records Management System. The flaw resides in the /projects/hospital/admin/complaints.php endpoint and is triggered through the id parameter. Authenticated attackers with low privileges can inject arbitrary SQL statements over the network. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying database. Because the application stores patient records, exploitation can expose protected health information and alter clinical complaint data. The vulnerability was published to the National Vulnerability Database (NVD) on January 12, 2026.

Critical Impact

Authenticated remote attackers can extract, modify, or destroy patient records stored in the backend database through a single vulnerable parameter.

Affected Products

• Imaster Patient Records Management System
• Vulnerable endpoint: /projects/hospital/admin/complaints.php
• Vulnerable parameter: id

Discovery Timeline

• 2026-01-12 - CVE-2025-41004 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-41004

Vulnerability Analysis

The vulnerability is a classic SQL Injection flaw [CWE-89] in the administrative complaints management feature of Imaster's Patient Records Management System. The complaints.php script accepts the id parameter from incoming HTTP requests and concatenates the value directly into a backend SQL query. The application does not validate the parameter type or apply parameterized queries before query execution.

An attacker authenticated to the admin interface can replace the expected numeric identifier with crafted SQL syntax. The injected payload alters the query logic and forces the database to return data outside the intended record scope. Patient records, credentials, and configuration tables become reachable through UNION-based or boolean-based techniques. The attacker can also chain stacked queries to write, update, or delete rows.

Root Cause

The root cause is unsanitized user input flowing into a dynamically constructed SQL statement. The application trusts the id parameter without enforcing type casting, allow-listing, or prepared statements. Standard escaping libraries are not applied at the data access layer.

Attack Vector

Exploitation requires network access to the admin interface and valid low-privilege credentials. An attacker sends a crafted HTTP request to /projects/hospital/admin/complaints.php with a malicious id value. The vulnerable parameter is processed server-side and reflected into the SQL query. No user interaction is required beyond the attacker's own request. Technical details are documented in the INCIBE CERT Security Notice.

Detection Methods for CVE-2025-41004

Indicators of Compromise

• HTTP requests to /projects/hospital/admin/complaints.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the id parameter.
• Unusually long or URL-encoded values in the id parameter that deviate from expected integer input.
• Web server access logs showing repeated requests to complaints.php from a single source within a short interval.
• Database error messages returned to the client indicating syntax errors or query failures.

Detection Strategies

• Deploy Web Application Firewall (WAF) signatures that flag SQL injection patterns against the complaints.php endpoint.
• Enable database query logging and alert on queries referencing the complaints table with unexpected UNION or INFORMATION_SCHEMA operators.
• Correlate authentication events for admin accounts with anomalous request volumes to administrative PHP scripts.

Monitoring Recommendations

• Forward web server and PHP error logs to a centralized logging platform for retention and analysis.
• Monitor outbound database connections and large result sets returned to the web tier as potential exfiltration signals.
• Track admin account session activity for off-hours logins followed by sustained requests to admin endpoints.

How to Mitigate CVE-2025-41004

Immediate Actions Required

• Restrict network access to the /projects/hospital/admin/ directory through IP allow-listing or VPN-only access until a fix is applied.
• Rotate credentials for all admin accounts and enforce multi-factor authentication on the administrative interface.
• Audit the complaints table and adjacent tables for unauthorized read or write activity.

Patch Information

No vendor patch reference is published in the NVD entry at the time of writing. Administrators should monitor the INCIBE CERT Security Notice for vendor remediation guidance and apply updates from Imaster as soon as they become available.

Workarounds

• Place a WAF in front of the application and block requests where the id parameter contains non-numeric characters.
• Refactor the affected query to use parameterized statements or PDO prepared statements with strict type binding.
• Apply server-side input validation that casts the id parameter to an integer before query construction.
• Remove or disable the complaints.php endpoint if the feature is not in active operational use.

# Example WAF rule (ModSecurity) blocking non-numeric id values on the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /projects/hospital/admin/complaints.php" \
  "chain,phase:2,deny,status:403,id:1004001,msg:'CVE-2025-41004 SQLi attempt'"
  SecRule ARGS:id "!@rx ^[0-9]+$" "t:none"