A critical SQL injection vulnerability in phpgurukul Hospital Management System 4.0 enables unauthenticated remote attackers to manipulate backend database operations.

This SQL injection flaw is located in the add-doctor.php script. The application fails to sanitize input provided through the 'docname' parameter, granting an unauthenticated attacker the ability to inject arbitrary SQL commands.

The ability to perform SQL injection allows an attacker to bypass authentication, access restricted patient or administrative data, and potentially modify or delete critical system information. With a CVSS score of 9.8, the potential for total system compromise is high, posing a severe threat to business operations and patient privacy.

Immediate Action: Verify with the vendor if an update is available to remediate the SQL injection vulnerability in version 4.0.

Proactive Monitoring: Inspect application logs for suspicious activity, specifically looking for SQL queries involving the 'docname' parameter that deviate from expected input formats.

Compensating Controls: Implement WAF filtering to inspect incoming traffic for SQL injection signatures before requests reach the application server.

Public Exploit Available: Unknown

Due to the critical nature of this SQL injection, administrators must treat this as a high-priority security event. Ensure that the application is updated immediately upon the release of a security patch and review all database access logs for signs of unauthorized activity.