CVE-2025-5364 is a High severity SQL injection flaw (CVSS 7.3) in Campcodes Online Hospital Management System 1.0, in /doctor/add-patient.php. The record lists no fixed version, so treat the code as unpatched, keep it off the public internet, and change the query handling in your own copy.
What's affected
The record names Campcodes Online Hospital Management System 1.0 as affected. The record gives the version as 1.0. The vulnerable input is the patname value handled by /doctor/add-patient.php.
The record does not list a patched release or a vendor advisory. Check the vendor site and the linked reports before you assume a newer download fixes it.
The record also says the exploit has been disclosed to the public, so assume that anyone who can reach the page can try it.
How to check if you're exposed
Start by finding out whether you run this software at all. Look for the file named in the record and for the patname value in the source tree:
find . -name "add-patient.php"
grep -rn "patname" .
If the value is placed straight into a SQL string, the code has the weakness. If it is passed to a prepared statement with bound parameters, it does not. Then check your web server logs for odd requests to that file and for database errors that appear around the same times.
What to do now
- Take the Campcodes Online Hospital Management System 1.0 instance off the public internet, or put it behind a VPN or an IP allow list, until the code is fixed.
- Replace string concatenation for the patname value with a prepared statement and bound parameters. Do the same for every other query in /doctor/add-patient.php.
- Run the web application database account with the least privileges it needs. It should not own the schema or read tables it never uses.
- Search the logs and the database for signs of misuse, and rotate any credentials stored in the affected tables if you see any.
- Watch the https://gold.safeguard.sh/vulnerability/CVE-2025-5364 page and the vendor site for a patched release, and plan a move to maintained software if none arrives.
Why it matters
This is CWE-89 (SQL injection), filed under the broader CWE-74 injection class. The page that adds a patient record takes free text such as a patient name, and that text reaches the database without enough care. A hospital system holds patient and staff data, so a database flaw there deserves quick attention even in a small deployment.
The mechanism is old and well understood. The application builds a database query by pasting user input into a string, and the database cannot tell where the programmer's query ends and the visitor's text begins. The cure is just as old: parameterised queries, input checks as a second layer, and a database account that cannot do more than the page needs.
Projects like this one often ship the same pattern in many files. One fixed parameter rarely means the whole application is safe, so review every query rather than only the one in the report.
Quick check
Is there a patch for this CVE?
The record does not name one. Check the vendor site and the linked reports, and treat the product as unpatched until you confirm a fixed release.
Is this being exploited in the wild?
The record is not on the CISA Known Exploited Vulnerabilities list. It does say the exploit has been disclosed publicly, so exposure is still a real risk.
Sources
Last reviewed: 18 October 2026.
