A critical SQL injection vulnerability in the phpgurukul Hospital Management System allows remote attackers to interact with the backend database through unsanitized input.

This vulnerability is a SQL injection flaw in the add-doctor.php script. An unauthenticated attacker can inject malicious SQL queries into the docname parameter, which is processed without adequate validation.

With a CVSS score of 9.8, this vulnerability poses a severe threat to the integrity of the hospital's clinical and administrative records. Exploitation could allow an attacker to read, modify, or delete sensitive records, leading to significant operational disruption and regulatory non-compliance.

Immediate Action: Apply the latest available update from the vendor to remediate the vulnerable parameter handling in add-doctor.php.

Proactive Monitoring: Monitor database query performance and audit logs for unusual or unauthorized query structures that deviate from expected application behavior.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect incoming traffic and block requests containing malicious SQL injection patterns targeting the add-doctor.php endpoint.

Public Exploit Available: Not specified

This vulnerability represents a significant security risk that could lead to a total compromise of the application's database. IT administrators should verify their version of the software and apply patches immediately to prevent unauthorized data access.