CVE-2025-5371
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Health Center Patient Record Management System 1.0 allows attackers to manipulate database queries through the Username parameter in /admin/admin.php. Attackers can potentially access, modify, or delete sensitive patient records and system data. Any organization using this specific software version is affected.
💻 Affected Systems
- SourceCodester Health Center Patient Record Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to patient record theft, system takeover, ransomware deployment, and permanent data destruction.
Likely Case
Unauthorized access to sensitive patient health information (PHI), credential theft, and potential data exfiltration.
If Mitigated
Limited impact with proper input validation, WAF protection, and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit requires admin panel access but SQL injection is trivial once authenticated; public exploit code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider replacing with alternative software or implementing custom fixes with parameterized queries.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF with SQL injection rules to block malicious requests
Input Validation Filter
allAdd server-side input validation to sanitize Username parameter
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement database monitoring and alerting for suspicious SQL queries
🔍 How to Verify
Check if Vulnerable:
Test the /admin/admin.php endpoint with SQL injection payloads in Username parameter while authenticatedCheck Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Verify parameterized queries are implemented and SQL injection attempts are properly rejected📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts with SQL syntax in Username field
Network Indicators:
- HTTP POST requests to /admin/admin.php containing SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/admin/admin.php" AND (param="Username" AND value MATCH "'|--|UNION|SELECT")