A critical SQL injection vulnerability in the Campcodes Online Hospital Management System 1.0 allows unauthenticated attackers to compromise database integrity and confidentiality.

The application is susceptible to SQL injection within the /admin/index.php file, specifically via the username parameter, which permits unauthenticated remote attackers to execute arbitrary SQL commands.

Successful exploitation poses a significant risk to the confidentiality, integrity, and availability of sensitive patient and administrative data. With a CVSS score of 7.3, this flaw represents a high-severity risk, as an attacker could potentially bypass authentication mechanisms, extract sensitive information, or disrupt the hospital management system.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/index.php interface using network-level controls or by disabling the affected component until a secure update is released.

Proactive Monitoring: Security teams should review web server access logs for unusual patterns or SQL syntax in the username field, such as single quotes or comment markers, which may indicate attempted exploitation.

Compensating Controls: Deploy a Web Application Firewall with rules configured to inspect incoming traffic for SQL injection payloads, specifically targeting the authentication parameters on the administrative login page.

Public Exploit Available: No — there is no confirmed weaponized exploit or public PoC repository in our curated sources.

Given the high CVSS score and the presence of a documented proof-of-concept, this vulnerability warrants immediate attention. Organizations utilizing this software must implement strict network segmentation to block access to the administrative portal from untrusted networks and prioritize the application of any forthcoming vendor security updates to mitigate this risk.