CVE-2025-4739 covers a high severity SQL injection (CVSS 7.3) in /medicines_info.php of projectworlds Hospital Database Management System 1.0.. Input passed in Med_ID is not handled safely before it is used in a query. No vendor fix is confirmed, so take the app off the open internet and patch the code.
What's affected
The record lists projectworlds Hospital Database Management System version 1.0.. Hospital Database Management System is a PHP application for hospital records. The weak spot is the file /medicines_info.php, and the parameter named in the record is Med_ID.
The record does not name a fixed version. The reference list holds a public issue report and the vendor homepage, and neither one, as far as the record shows, points to a patched release. Treat every copy of version 1.0. as affected until the vendor says otherwise, and check the vendor site for a newer download before you rely on this post.
How to check if you're exposed
Start by finding out whether you run this application at all. These apps are often installed once by one person and then forgotten, so look at web roots, not only at your asset list.
find /var/www -name "medicines_info.php" 2>/dev/null
grep -rn "Med_ID" --include="medicines_info.php" /var/www 2>/dev/null
Then look at who can reach it. If the web server is open to the internet, assume the flaw is reachable. The public report that accompanies the CVE says no login is needed to reach the vulnerable code, which matches the record, where privileges required is set to none.
Check your access logs for requests to the file. Unusual values in the Med_ID parameter, very long values, or a burst of requests from one address are worth a closer look.
grep -c "medicines_info.php" /var/log/nginx/access.log
Adjust the log path to your server. If you cannot tell, open the file and see whether the parameter is placed straight into a query string.
What to do now
- Find every copy of Hospital Database Management System 1.0. that you run, including test and staging copies.
- Take the app off the public internet. Put it behind a VPN, an IP allowlist or a login at the web server.
- Check the vendor site for a newer release and read its notes. If none exists, plan to fix the code yourself or retire the app.
- Change the query in
/medicines_info.phpto use prepared statements with bound parameters, and validate the type ofMed_ID. - Give the database account used by the app only the rights it needs, and rotate its password if you saw suspicious requests.
- Review the logs and the database for changes you did not make.
Why it matters
The record maps this to CWE-89, SQL injection, and the parent class CWE-74, injection. The cause is the oldest one in web security: a value from the request is joined to a SQL statement as text, so the database cannot tell data from instructions. Prepared statements keep the two apart.
The score of 7.3 reflects a network attack that needs no account and no user action, with limited impact on confidentiality, integrity and availability. That is a real risk for any app that stores visitor, customer or student records. The record says the exploit has been disclosed to the public. This CVE is not on the CISA Known Exploited Vulnerabilities list, and nothing here says it is exploited in the wild.
Many apps of this kind carry several flaws of the same shape, because the same coding habit repeats across files. Fixing one parameter and leaving the rest is a weak answer. Search the whole code base for queries built from request values.
Try it yourself
This demo shows how a scan finds flaws like this one in code or in a running app.
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched version of Hospital Database Management System?
The record and the public report do not name one. Check the vendor site for a newer release, and treat version 1.0. as affected until you confirm a fix.
Is CVE-2025-4739 being exploited in the wild?
The record says the exploit has been disclosed publicly, but the CVE is not in the CISA Known Exploited Vulnerabilities list. Treat it as likely to be tried against any exposed copy.
If you want a fast look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan lists known issues in a manifest, and the Gold directory has a page for each CVE.
Sources
Last reviewed: 18 October 2026.
