CVE-2025-7754: Patient Record Management System SQLi Flaw

CVE-2025-7754 Overview

CVE-2025-7754 is a SQL injection vulnerability in code-projects Patient Record Management System 1.0. The flaw resides in the /xray_form.php script, where the itr_no parameter is passed directly into a database query without proper sanitization. An authenticated attacker can manipulate this parameter to inject arbitrary SQL statements against the backend database. The exploit can be triggered remotely over the network and has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations. The vulnerability is tracked under CWE-89 (SQL Injection) and CWE-74 (Improper Neutralization of Special Elements in Output).

Critical Impact

Remote attackers with low privileges can inject SQL via the itr_no parameter in /xray_form.php, leading to unauthorized read or modification of patient records.

Affected Products

• Fabianros Patient Record Management System 1.0
• Component: /xray_form.php
• CPE: cpe:2.3:a:fabianros:patient_record_management_system:1.0

Discovery Timeline

• 2025-07-17 - CVE-2025-7754 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-7754

Vulnerability Analysis

The vulnerability exists in the X-ray form handler at /xray_form.php. The application accepts the itr_no HTTP parameter and concatenates the value directly into a SQL statement issued to the backend database. Because the input is neither parameterized nor escaped, attackers can break out of the query context and append arbitrary SQL clauses.

Successful exploitation allows an attacker to read patient records, exfiltrate credentials, modify medical data, or potentially escalate to database-level command execution depending on the database engine and its configuration. The EPSS score of 0.138% reflects current observed exploitation telemetry, but public disclosure of the technique raises the risk profile for internet-exposed deployments.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The itr_no argument is treated as trusted input and inserted into the query string without prepared statements or input validation. This pattern is common across PHP applications that rely on string concatenation with mysqli_query or equivalent calls instead of parameter binding.

Attack Vector

The attack vector is remote and requires only low-privileged access to the application. An attacker submits a crafted value for the itr_no parameter when interacting with the X-ray form endpoint. Because the endpoint is reachable over HTTP, exploitation does not require user interaction beyond the attacker's own authenticated session. A typical payload terminates the original SQL clause and appends a UNION SELECT or boolean-based condition to extract data from information_schema or application tables. See the GitHub CVE Analysis Document for the published proof-of-concept details.

Detection Methods for CVE-2025-7754

Indicators of Compromise

• HTTP requests to /xray_form.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or OR 1=1 in the itr_no parameter.
• Unusual database errors or stack traces returned from /xray_form.php responses.
• Spikes in outbound traffic from the web server following requests to the vulnerable endpoint.

Detection Strategies

• Deploy web application firewall (WAF) signatures targeting SQL injection patterns on the itr_no query parameter.
• Enable database query logging and alert on queries originating from /xray_form.php that contain unexpected UNION, SLEEP, or INFORMATION_SCHEMA references.
• Review web server access logs for repeated requests to /xray_form.php with encoded payloads such as %27, %20OR%20, or %23.

Monitoring Recommendations

• Continuously monitor authentication and session activity for the Patient Record Management System to identify abuse of low-privileged accounts.
• Correlate web access logs with database audit logs to detect anomalous query patterns tied to the vulnerable endpoint.
• Establish alerts for new outbound connections from the application server that could indicate data exfiltration following injection.

How to Mitigate CVE-2025-7754

Immediate Actions Required

• Restrict network access to the Patient Record Management System to trusted networks or VPN clients until a fix is applied.
• Disable or place the /xray_form.php endpoint behind a WAF rule that blocks SQL metacharacters in the itr_no parameter.
• Rotate database credentials used by the application and review recent records for unauthorized changes.

Patch Information

No official vendor patch has been published in the enriched advisory data. Administrators should monitor code-projects.org and the VulDB entry #316744 for any forthcoming updates. In the absence of a patch, source code modifications to replace string concatenation with parameterized queries are required.

Workarounds

• Modify /xray_form.php to use prepared statements with bound parameters (for example, mysqli::prepare with bind_param) instead of inline SQL string building.
• Apply server-side input validation to ensure itr_no accepts only the expected numeric format before reaching the database layer.
• Enforce least-privilege permissions on the database account used by the application to limit the blast radius of any successful injection.

# Example WAF rule (ModSecurity) to block SQL metacharacters in itr_no
SecRule ARGS:itr_no "@rx (?i)(union(.*?)select|sleep\(|information_schema|--|;|')" \
    "id:1007754,phase:2,deny,status:403,log,msg:'CVE-2025-7754 SQLi attempt on xray_form.php'"