CVE-2025-63497: Rickxy Hospital Management System SQLi

CVE-2025-63497 Overview

CVE-2025-63497 is an SQL injection vulnerability in rickxy Hospital Management System version 1.0. The flaw resides in the patient prescription viewing functionality implemented in his_doc_view_single_patient.php. The pat_number GET parameter is concatenated directly into SQL queries without sanitization or parameterization. Authenticated attackers holding the doctor role can inject arbitrary SQL statements to read, modify, or delete database records. The vulnerability is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated doctor-role users can execute arbitrary SQL queries against the backend database, exposing patient records and enabling integrity attacks on medical data.

Affected Products

rickxy Hospital Management System version 1.0
his_doc_view_single_patient.php component
Deployments exposing the doctor-role interface over the network

Discovery Timeline

2025-11-10 - CVE-2025-63497 published to NVD
2025-12-11 - Last updated in NVD database

Technical Details for CVE-2025-63497

Vulnerability Analysis

The vulnerability exists in the prescription viewing workflow of rickxy Hospital Management System 1.0. When a user with the doctor role requests a patient's prescription record, the application receives the pat_number value through an HTTP GET parameter. The script his_doc_view_single_patient.php builds an SQL query by string concatenation, inserting the parameter value directly into the query body. No prepared statements, parameter binding, or input validation routines guard the parameter before it reaches the database driver.

An attacker authenticated as a doctor can append SQL syntax to the pat_number value to alter query semantics. UNION-based payloads can exfiltrate data from arbitrary tables, including credentials, patient demographics, and clinical notes. Stacked queries or boolean-based payloads can modify or destroy records. The exposure is limited to authenticated sessions, but doctor accounts are routinely provisioned across hospital workflows, broadening the practical attack surface.

Root Cause

The root cause is unsafe concatenation of untrusted user input into an SQL statement. The application does not use parameterized queries and does not enforce type or format checks on pat_number, which should be a numeric identifier.

Attack Vector

Exploitation requires network access to the application and valid doctor-role credentials. The attacker sends a crafted GET request to his_doc_view_single_patient.php with a malicious pat_number value. The injected SQL executes within the application's database context.

// Vulnerability described in prose only - no verified PoC code published in NVD data.
// See the GitHub security research report linked in the references for technical details.

Detection Methods for CVE-2025-63497

Indicators of Compromise

HTTP requests to his_doc_view_single_patient.php containing SQL keywords such as UNION, SELECT, SLEEP, or comment markers (--, #) in the pat_number parameter.
Database error messages or unusually long response times tied to prescription view requests.
Unexpected reads against sensitive tables (users, credentials, patient records) originating from the web application service account.

Detection Strategies

Inspect web server access logs for pat_number values that are non-numeric or contain URL-encoded SQL syntax.
Deploy a web application firewall rule set targeting SQL injection patterns on the prescription endpoint.
Enable database query logging and alert on queries referencing tables that the prescription view should not access.

Monitoring Recommendations

Correlate authentication events for doctor-role accounts with anomalous request volumes to his_doc_view_single_patient.php.
Track outbound data volumes from the database server to identify potential bulk exfiltration.
Review audit logs for record modifications outside expected clinical workflows.

How to Mitigate CVE-2025-63497

Immediate Actions Required

Restrict network exposure of the Hospital Management System to trusted clinical networks until a fix is deployed.
Rotate credentials for all doctor-role accounts and review recent session activity.
Apply input validation at a reverse proxy or WAF to reject non-numeric pat_number values.

Patch Information

No official vendor patch is referenced in the NVD entry at the time of publication. Refer to the GitHub CVE-2025-63497 Report and the GitHub Hospital Management System repository for technical analysis. Operators should rewrite the affected query using parameterized statements and cast pat_number to an integer before use.

Workarounds

Place the application behind a WAF with SQL injection signatures enabled for the pat_number parameter.
Enforce least-privilege database accounts so the web application cannot read or modify tables outside the prescription scope.
Disable or remove the prescription viewing route until the parameter is properly sanitized.

bash

# Example WAF rule (ModSecurity) to block non-numeric pat_number values
SecRule ARGS:pat_number "!@rx ^[0-9]+$" \
  "id:1006349,phase:2,deny,status:400,log,msg:'CVE-2025-63497 - invalid pat_number'"