CVE-2025-5298 is a high severity (CVSS 7.3) SQL injection in Campcodes Online Hospital Management System 1.0. The fromdate and todate parameters of a report page in the admin area are not handled safely. The record lists no patch, so limit access to the app and fix the query code if you run it.
What's affected
The record names Campcodes Online Hospital Management System 1.0 and the file /admin/betweendates-detailsreports.php. The manipulation of the fromdate and todate arguments leads to SQL injection, tracked as CWE-89 and CWE-74.
The record says the attack can be launched remotely and that the exploit has been disclosed to the public. No fixed release is named, and the references are a public issue write up and VulDB entries. Treat this as an unpatched weakness in a sample style application and check the Campcodes site for any update.
Applications of this type are often downloaded as source code and edited by whoever deploys them. That means the same bug can appear in forks with different names.
How to check if you're exposed
Find out whether the application is deployed anywhere. Search web roots for the file path named in the record:
find /var/www -name "betweendates-detailsreports.php" 2>/dev/null
If the file exists, open it and see how the two date values reach the query. Any place where request values are joined into SQL text, instead of passed as bound parameters, has the same flaw class.
Check the web server access logs for requests to that page with unusual values in the date fields, and for database error messages in the response. A DAST scan against a test copy will also show whether the endpoint is injectable.
What to do now
- Find every deployment of this application, including demos and training copies that hold real records.
- Take the application off the public internet or place it behind a VPN or an allow list.
- Change the code to use prepared statements with bound parameters for the date fields, and check other pages for the same pattern.
- Run the database account with the least rights it needs, with no file or administrative privileges.
- Review database and web logs for abnormal queries, and rotate stored credentials if you find any.
Why it matters
SQL injection occurs when user input becomes part of a query without being separated from the query structure. The database cannot tell the author's SQL from the attacker's, so the attacker can read, change or delete data, depending on the account's rights.
For a hospital style application the data would be patient and staff records, which is why any deployment should not face the internet. The record also notes the report page lives under the admin folder, though it does not say whether a login is required, so verify that on your own copy. This CVE is not on the CISA Known Exploited Vulnerabilities list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a fix available?
The record and its references do not name one. Fix the query code yourself, or take the app out of service.
Sources
Last reviewed: 18 October 2026.
