CVE-2025-5229 is a high severity SQL injection (CVSS 7.3) in Campcodes Online Hospital Management System 1.0. The viewid parameter handled by /admin/view-patient.php is not safely handled in a database query. The record lists no fixed version, so treat the software as unpatched and review exposure and code.
What's affected
The CVE record names Campcodes Online Hospital Management System 1.0. The weak spot is the file /admin/view-patient.php, where the viewid parameter reaches a database query. The weakness is classed as CWE-89 (SQL injection) and CWE-74 (injection in general).
The record describes the attack as remote and says an exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false for this CVE. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: network reachable, low complexity, no privileges, no user interaction, and low impact on confidentiality, integrity and availability.
No fixed release is listed in the record. Check the vendor site, the project download page and the VulDB entry for any later version before you decide how to proceed.
This is one of several separate CVEs filed against the same product, each for a different file. CVE-2025-5208, CVE-2025-5224, CVE-2025-5246 cover other pages. Fixing only the file named here leaves the others open, so review the whole application.
How to check if you're exposed
Start with inventory. Find every copy of Online Hospital Management System you run, including test and staging copies, and note the version. The record only names 1.0, so a different version is not proven safe, only unreported.
On the server, look at how the file builds its query. From the application root:
grep -n "viewid" ./admin/view-patient.php
grep -n "mysqli_query\|->query(" ./admin/view-patient.php
If you see the request value joined into a SQL string, the code is the kind the record describes. Code that uses prepared statements with bound values does not have this weakness.
Then check reachability. From a machine outside your network, confirm whether the path /admin/view-patient.php answers at all. Review web server access logs for requests to that path that contain quote characters, SQL keywords or very long values, and review database logs for errors or odd queries around the same times.
If the app has a Composer file, the free in-browser dependency scan at gold.safeguard.sh/scan can list known issues in its libraries. It will not find a flaw in the app's own code, so the code review above is still needed.
What to do now
- List every deployment of Online Hospital Management System and decide which ones must stay online.
- Take internet exposure away. Put the app behind a VPN or an IP allow list, or switch it off until it is fixed.
- Change the code that builds the query for
/admin/view-patient.phpto use prepared statements. A minimal pattern in PHP looks like this:
$stmt = $con->prepare("SELECT id FROM users WHERE email = ?");
$stmt->bind_param("s", $email);
$stmt->execute();
- Apply the same change to every other query in the app that uses request data, not only this file.
- Give the database account the least access it needs, with no rights to other schemas and no file or admin privileges.
- Check for a newer vendor release and compare its notes with this CVE. If the vendor has gone quiet, plan to replace the software.
- If real data lives in the system, preserve logs and a database copy, review them for unusual reads, and rotate passwords stored in it.
Why it matters
Hospital software is a poor place for a database flaw. A hospital management system typically stores patient and doctor records, appointments and staff logins, so a query that can be bent by user input puts personal and health related data at risk. Check your local rules on breach notification if this software holds real patient data.
SQL injection happens when the text a user sends becomes part of a database command instead of staying plain data. It is among the oldest and best understood classes of bug. Prepared statements prevent it, and that is why it keeps showing up in small PHP applications written without them. The affected file lives under an admin path, but the CVSS vector still says no privileges are required, so do not assume the path is protected unless you have checked.
Because this is hospital software, start by asking what real data it holds. If it is a demo or a training install with sample data, the urgency is lower. If it holds actual patient or staff records, treat it as a priority and review database logs for unusual activity.
Quick check
Is CVE-2025-5229 fixed?
The CVE record lists no fixed version for Online Hospital Management System 1.0. Check the vendor and project pages, and until a patched release exists, reduce exposure and fix the query code yourself.
Is this being exploited in the wild?
The record says an exploit has been disclosed to the public, but the CISA Known Exploited Vulnerabilities flag is false. Public exploit details raise the chance of attacks, so act as though scanning is likely.
Sources
- Safeguard Gold record: https://gold.safeguard.sh/vulnerability/CVE-2025-5229
- CVE record data for CVE-2025-5229, including the VulDB entry and the issue tracker link it lists. The vendor pages and VulDB could not be retrieved while this post was written, so confirm fixed versions with the vendor.
Last reviewed: 18 October 2026.
