CVE-2025-63497
The patient prescription viewing functionality in his_doc_view_single_patient.php of rickxy Hospital Management System version 1.0 contains an SQL injection vulnerability. The p…
Published: 2025-11-10 · CVSS: 7.1 · CVSS 3.1
The patient prescription viewing functionality in his_doc_view_single_patient.php of rickxy Hospital Management System version 1.0 contains an SQL injection vulnerability. The pat_number GET parameter is directly concatenated into SQL queries without proper sanitization, allowing authenticated attackers (doctor role) to execute arbitrary SQL queries.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7