CVE-2025-4933
ponaravindb Hospital-Management-System doctor-panel.php sql injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- May 19, 2025
- Updated
- May 19, 2025
- Reserved
- May 18, 2025
Description
A vulnerability, which was classified as critical, was found in ponaravindb Hospital-Management-System 1.0. This affects an unknown part of the file /doctor-panel.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Hospital-Management-Systemponaravindb |
|
References
- VDB-309495 | ponaravindb Hospital-Management-System doctor-panel.php sql injectionvdb-entrytechnical-description
- VDB-309495 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #579678 | GITHUB/ponaravindb/ Hospital-Management-System v1.0 sql injectionthird-party-advisory
- https://github.com/zylv0002/SQLi-ponaravindb-HMSexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.