CVE-2025-5360: Hospital Management System SQLi Flaw

CVE-2025-5360 Overview

CVE-2025-5360 is a SQL injection vulnerability in Campcodes Online Hospital Management System 1.0. The flaw resides in /book-appointment.php, where the doctor parameter is passed unsanitized into a database query. Remote attackers can manipulate this parameter to inject arbitrary SQL statements without authentication or user interaction. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed deployments. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization in Output).

Critical Impact
Unauthenticated remote attackers can extract, modify, or delete sensitive patient data stored in the application's database through SQL injection in the appointment booking endpoint.

Affected Products

Campcodes Online Hospital Management System 1.0
Deployments exposing /book-appointment.php to untrusted networks
Installations using the default doctor parameter handling

Discovery Timeline

2025-05-30 - CVE-2025-5360 published to NVD
2025-06-03 - Last updated in NVD database

Technical Details for CVE-2025-5360

Vulnerability Analysis

The vulnerability exists in the appointment booking workflow of Campcodes Online Hospital Management System 1.0. The /book-appointment.php script accepts a doctor request parameter and concatenates it directly into a SQL query without input validation or parameterized binding. Attackers can submit crafted values that alter the structure of the underlying query.

Because the endpoint is reachable over the network and requires no authentication, exploitation can occur remotely with low complexity. A public proof-of-concept reference has been disclosed through the GitHub CVE Issue Tracker and indexed in VulDB #310654. The EPSS probability stands at 0.277% as of the latest scoring date.

Root Cause

The root cause is improper neutralization of user-supplied input before inclusion in a SQL statement. The doctor parameter flows from the HTTP request into the query builder without escaping, prepared statements, or whitelist validation. This allows attackers to break out of the intended query context.

Attack Vector

An unauthenticated attacker sends an HTTP request to /book-appointment.php with a malicious payload in the doctor parameter. Typical exploitation patterns include UNION-based extraction of records from tables such as users, patients, and appointments, boolean-blind techniques to enumerate schema contents, and time-based payloads using SLEEP() to confirm injection on environments that suppress error output.

No verified exploit code is published for this article. Refer to the GitHub CVE Issue Tracker entry for technical details on the disclosed proof of concept.

Detection Methods for CVE-2025-5360

Indicators of Compromise

HTTP requests to /book-appointment.php containing SQL meta-characters such as ', --, UNION, SELECT, or SLEEP( in the doctor parameter
Web server access logs showing unusually long query strings or URL-encoded SQL keywords targeting the appointment endpoint
Database error messages referencing syntax errors originating from the appointment booking flow
Anomalous outbound data volume from the web server tied to database response sizes

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the doctor parameter for SQL injection signatures and block requests on match
Enable database query logging and alert on queries from the appointment module containing concatenated literals or UNION SELECT patterns
Correlate web access logs with database audit logs to identify request-to-query mappings indicative of injection

Monitoring Recommendations

Monitor authentication tables for unexpected reads or modifications originating from the web application service account
Track request rates against /book-appointment.php and alert on bursts from a single source address
Review backup integrity and database schema for unauthorized changes on a recurring schedule

How to Mitigate CVE-2025-5360

Immediate Actions Required

Restrict network access to the Online Hospital Management System until a patched build is available, allowing only trusted IP ranges
Place the application behind a WAF with SQL injection rule sets enabled in blocking mode
Audit existing database contents for signs of tampering and rotate credentials stored in the affected tables
Disable or remove the /book-appointment.php endpoint if it is not required for production operations

Patch Information

No official vendor patch is referenced in the NVD entry at the time of writing. Consult the Campcodes website for updates. Until a fix is released, apply compensating controls and consider migrating to a supported hospital management platform.

Workarounds

Implement parameterized queries or prepared statements in any custom modifications to /book-appointment.php
Apply server-side input validation that restricts the doctor parameter to expected numeric identifiers
Enforce least-privilege database accounts so the web application user cannot read sensitive tables outside its scope
Enable verbose logging on the database and web tiers to support post-incident forensic review

bash

# Example WAF rule (ModSecurity) to block SQLi patterns on the doctor parameter
SecRule ARGS:doctor "@detectSQLi" \
    "id:1005360,phase:2,deny,status:403,\
    msg:'CVE-2025-5360 SQLi attempt on /book-appointment.php'"