CVE-2025-4197: Patient Record Management System SQLi Flaw

CVE-2025-4197 Overview

CVE-2025-4197 is a SQL injection vulnerability in code-projects Patient Record Management System 1.0. The flaw exists in /edit_xpatient.php, where the lastname parameter is passed unsanitized into a backend SQL query. Authenticated attackers can manipulate the parameter remotely to alter query logic and access or modify database contents. The vulnerability is tracked under CWE-89 (SQL Injection) and CWE-74 (Improper Neutralization of Special Elements in Output). According to the advisory, other parameters in the same endpoint may also be exploitable. Public disclosure of the exploit details has occurred through VulDB #306810.

Critical Impact
Remote authenticated attackers can inject arbitrary SQL through the lastname parameter in /edit_xpatient.php, exposing patient records and enabling unauthorized data modification.

Affected Products

code-projects Patient Record Management System 1.0
CPE: cpe:2.3:a:code-projects:patient_record_management_system:1.0:*:*:*:*:*:*:*
Endpoint: /edit_xpatient.php

Discovery Timeline

2025-05-02 - CVE-2025-4197 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4197

Vulnerability Analysis

The vulnerability resides in the edit_xpatient.php script of the Patient Record Management System. The application accepts the lastname HTTP parameter and concatenates it directly into a SQL statement without parameterization or input sanitization. An attacker submitting a crafted value can break out of the intended string context and append arbitrary SQL clauses.

Exploitation requires network access and low-privileged authentication. Successful injection allows attackers to enumerate database schemas, dump patient records, modify clinical data, or escalate to administrative accounts depending on database permissions. The advisory notes that additional parameters in the same file may share the flaw, expanding the attack surface beyond the documented lastname field.

The EPSS score is approximately 0.389% (percentile 30.6), reflecting low observed exploitation likelihood. However, the vulnerability has been publicly disclosed, lowering the barrier to weaponization.

Root Cause

The root cause is improper neutralization of special characters in user input before inclusion in a SQL query [CWE-89]. The PHP code handling the lastname parameter lacks prepared statements, parameter binding, or input validation. Any character — including single quotes, comment markers, and SQL keywords — is passed verbatim to the MySQL backend.

Attack Vector

The attack vector is network-based and requires low privileges. An authenticated user submits a POST or GET request to /edit_xpatient.php with a malicious lastname value such as a UNION-based payload or boolean-based blind injection string. The injected SQL executes within the application's database context, returning data or triggering side effects in the query result.

No verified proof-of-concept code is available beyond the reference documentation hosted at the GitHub CVE Documentation. Refer to that source for the original technical write-up.

Detection Methods for CVE-2025-4197

Indicators of Compromise

HTTP requests to /edit_xpatient.php containing SQL metacharacters such as single quotes, UNION SELECT, OR 1=1, or comment sequences (--, #) in the lastname parameter.
Anomalous database queries originating from the Patient Record Management System web user, including queries referencing information_schema or system tables.
Web server access logs showing repeated requests to edit_xpatient.php from a single source with varying parameter payloads.

Detection Strategies

Deploy web application firewall (WAF) signatures targeting SQL injection patterns in POST and GET parameters submitted to /edit_xpatient.php.
Enable MySQL general query logging and alert on queries containing tautologies, UNION-based extraction, or schema enumeration originating from the application user.
Correlate authentication events with downstream database activity to identify low-privileged accounts performing schema-level reconnaissance.

Monitoring Recommendations

Monitor inbound HTTP traffic to all edit_*.php endpoints for unusual parameter lengths or encoded SQL syntax.
Track database error responses returned to the web tier, which often indicate active injection probing.
Audit user accounts and patient record tables for unexpected modifications, new administrative accounts, or bulk data reads.

How to Mitigate CVE-2025-4197

Immediate Actions Required

Restrict network access to the Patient Record Management System to trusted internal networks or VPN clients until a patch is available.
Disable or remove the edit_xpatient.php functionality if it is not actively required by clinical workflows.
Rotate database credentials and audit privileges granted to the application's database user, applying the principle of least privilege.
Review web and database logs for prior exploitation activity targeting the affected parameter.

Patch Information

No vendor patch has been published by code-projects at the time of NVD listing. Refer to the Code Projects site for any future updates. Organizations using this software should consider compensating controls or migrating to a maintained patient management solution.

Workarounds

Place the application behind a WAF with SQL injection rule sets enabled in blocking mode.
Implement input validation at a reverse proxy layer to reject non-alphabetic characters in name fields.
Modify the source PHP to use parameterized queries with PDO or mysqli prepared statements for all parameters in edit_xpatient.php.
Apply database-level controls limiting the application account to SELECT, INSERT, and UPDATE on required tables only, denying access to information_schema where possible.

bash

# Example WAF rule (ModSecurity) to block SQLi attempts on the affected endpoint
SecRule REQUEST_URI "@contains /edit_xpatient.php" \
  "chain,phase:2,deny,status:403,id:1004197,msg:'CVE-2025-4197 SQLi attempt'"
SecRule ARGS:lastname "@detectSQLi" \
  "t:none,t:urlDecodeUni"