CVE-2025-9771 is a high severity SQL injection flaw (CVSS 7.3) in the SourceCodester Eye Clinic Management System, version 1.0. The Search parameter of /main/search_index_Diagnosis.php reaches a database query without safe handling. I could not confirm a vendor fix, so restrict access, review the code and check the advisory for updates.
What's affected
The record lists SourceCodester Eye Clinic Management System version 1.0 as affected. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which describes a network attack with low complexity that needs no privileges and no user interaction.
Fixed versions: I could not confirm one. The record and the reporter's page I read describe the flaw in the project's published source and do not point to a patched release. Check the vendor's download page and the project listing before assuming a fix exists.
How to check if you're exposed
Start by finding out whether you run this software at all. It is a downloadable PHP sample project, often installed for learning or as a quick internal tool, so it may sit on a forgotten server.
On the web server, search the application folder for the file and the parameter named in the record.
find /var/www -name "search_index_Diagnosis.php" 2>/dev/null
grep -rnE "\$_(GET|POST|REQUEST)" /var/www/path/to/app | grep -i "Search"
Replace the path with your install folder. In the hits, look for the Search value being placed straight into an SQL string. That is the weakness class, and a prepared statement with bound parameters is the fix pattern.
Then check the access log for requests to /main/search_index_Diagnosis.php from addresses you do not recognise, and for unusual characters such as quotes in the Search value.
grep "search_index_Diagnosis.php" /var/log/apache2/access.log | tail -n 50
Adjust the log path for your server. A clean log does not prove safety, since public tooling probes these pages quickly, but it tells you whether anyone has been looking.
For application code you build or deploy, the free in-browser dependency scan at gold.safeguard.sh/scan covers your third party packages, and the Gold directory lets you look up a CVE like this one by id. Neither replaces reading hand written code, so pair them with a code review of query and upload handling.
What to do now
- Take /main/search_index_Diagnosis.php off the public internet, or put the whole application behind a VPN or an allow list of known addresses.
- Review every query in the application that uses a request value. Rewrite them as prepared statements with bound parameters, starting with the Search handling in /main/search_index_Diagnosis.php.
- Run the database account with the fewest rights the app needs. It should not own other schemas or hold file write rights.
- Add a web application firewall rule for SQL metacharacters as a stopgap. It is a delay, not a fix.
- Check the vendor page and the project listing for a patched release, and read the advisory again before you assume none exists.
- If this app holds real personal or financial data, treat it as potentially exposed, rotate credentials stored in its database and review backups.
- If you cannot fix it, retire it. A sample project with no maintainer is a poor home for production data.
Why it matters
The cause is a familiar one. The application takes the Search value from the request and builds an SQL statement by joining strings. The database cannot tell the developer's query from the attacker's text. This is CWE-74 (Injection) and CWE-89 (SQL Injection). NVD lists the broader injection class together with the specific SQL form.
The fix is not clever. Prepared statements keep the query shape fixed and send values separately. The same pattern, repeated across many sample projects, explains why this CVE is one of a long run of near identical records.
The parameter is a search term. Search boxes feed free text into queries by design, so they are a classic place for unescaped input to reach the database.
The record says an exploit has been made public. That is not the same as exploitation in the wild. This CVE is not in CISA's Known Exploited Vulnerabilities catalog, and nothing I fetched claims active attacks. Still, public details lower the effort for anyone who goes looking for installs.
Quick check
Is CVE-2025-9771 exploited in the wild?
The record does not say so and the CVE is not in the CISA Known Exploited Vulnerabilities catalog. It does say an exploit has been made public, so treat exposure as real.
Is there a patched version of Eye Clinic Management System?
I could not confirm one. Check the vendor page and project listing, and fix the query handling yourself if you must keep running the app.
Sources
- Gold page for CVE-2025-9771
- NVD record data for CVE-2025-9771, as held in the Safeguard content batch
Source note: the reporter's page linked in the record could not be read when I checked, so this post rests on the NVD record. It names no vendor advisory or fixed version.
Last reviewed: 18 October 2026.
