CVE-2025-5298

published 2025-05-28

CVE-2025-5298: A vulnerability, which was classified as critical, was found in Campcodes Online Hospital Management System 1.0. Affected is an unknown function of the file…

Priority P2 62 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

A vulnerability, which was classified as critical, was found in Campcodes Online Hospital Management System 1.0. Affected is an unknown function of the file /admin/betweendates-detailsreports.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
campcodes	online_hospital_management_system	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /HospitalManagementSystem/hospital/hms/admin/betweendates-detailsreports.php↗

command fromdate=2019-01-01' AND (SELECT 5962 FROM (SELECT(SLEEP(5)))danz) AND 'awPP'='awPP&todate=2025-05-28&submit=↗

command fromdate=2019-01-01&todate=2025-05-28' AND 3290=3290 AND 'yOfc'='yOfc&submit=↗

command fromdate=2019-01-01&todate=2025-05-28' UNION ALL SELECT CONCAT(CONCAT('qkpxq','eLwmjRlXmPYByrACqjbUDqzOqYmBeKwQSUSMNXdM'),'qzzbq'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- ckvh&submit=↗

• → Monitor POST requests to '/admin/betweendates-detailsreports.php' for payloads containing SLEEP() function calls in the 'fromdate' parameter, indicative of time-based blind SQLi. ↗
• → Detect UNION-based SQL injection attempts in the 'todate' POST parameter targeting an 11-column table structure, identifiable by the NULL-padded UNION ALL SELECT pattern and comment terminator '-- ckvh'. ↗
• → Flag inbound HTTP POST requests to the path '/HospitalManagementSystem/hospital/hms/admin/betweendates-detailsreports.php' from external/remote sources as this endpoint is the confirmed attack vector. ↗

• · The exploit was tested on a local instance (127.0.0.1); the base path '/HospitalManagementSystem/hospital/hms/' may vary across deployments. Detection rules should account for variable installation paths and focus on the filename 'betweendates-detailsreports.php'. ↗
• · The PHPSESSID and ajs_anonymous_id cookie values in the exploit are specific to the researcher's test session and should NOT be used as static IOCs for detection; focus on the URL path and POST body patterns instead. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-74 CWE-89