Campcodes Hospital Management System 1.0 contains a critical SQL injection vulnerability in the admin login portal that allows for remote, unauthenticated unauthorized access.

This is a SQL injection flaw (CWE-89) located in the admin dashboard login functionality. An unauthenticated attacker can inject malicious SQL commands via the password parameter to bypass authentication or manipulate backend database queries.

Successful exploitation of this vulnerability allows an unauthenticated attacker to bypass authentication mechanisms, potentially gaining full administrative control over the Hospital Management System. This poses a severe risk of data breach, unauthorized access to sensitive patient records, and full system compromise, justifying the CVSS score of 7.3.

Immediate Action: There is currently no official patch from the vendor for this version. Administrators should restrict access to the /admin/ directory using network-level controls or IP allowlisting until an official security update is released by Campcodes.

Proactive Monitoring: Review web server and database logs for anomalous SQL syntax, such as union-based queries or unexpected character sequences, originating from the admin login endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting login parameters.

Public Exploit Available: Yes — a technical write-up containing attack details and proof-of-concept information is available via the Yashh-G GitHub repository.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a significant risk to the integrity and confidentiality of the Hospital Management System. Administrators are strongly urged to isolate the administrative interface from the public internet immediately and monitor for any suspicious access attempts until the vendor provides a formal patch.