CVE-2025-5361
📋 TL;DR
This critical SQL injection vulnerability in Campcodes Online Hospital Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'fullname' parameter in /contact.php. This can lead to unauthorized database access, data theft, or system compromise. All deployments of version 1.0 are affected.
💻 Affected Systems
- Campcodes Online Hospital Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including patient medical records, administrative credentials, and system takeover leading to data breach, ransomware deployment, or service disruption.
Likely Case
Data exfiltration of sensitive patient information, administrative credentials harvesting, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and WAF rules blocking SQL injection patterns, though risk remains if workarounds are bypassed.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.campcodes.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates. Consider migrating to alternative software if no fix is provided.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side input validation to sanitize the fullname parameter in contact.php
Edit contact.php to add: $fullname = mysqli_real_escape_string($connection, $_POST['fullname']);
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns targeting /contact.php
ModSecurity rule: SecRule ARGS:fullname "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Block external access to /contact.php via firewall rules or web server configuration
- Implement network segmentation to isolate the vulnerable system from sensitive data stores
🔍 How to Verify
Check if Vulnerable:
Test /contact.php with SQL injection payloads in fullname parameter: ' OR '1'='1Check Version:
Check application version in admin panel or readme filesVerify Fix Applied:
Attempt SQL injection after applying workarounds; successful payloads should be blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts from contact.php
- SQL syntax errors in web server logs
Network Indicators:
- HTTP POST requests to /contact.php with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/contact.php" AND (fullname="*OR*" OR fullname="*UNION*" OR fullname="*SELECT*")