PT-2025-46180 · Unknown · Rickxy Hospital Management System

Published 2025-11-10 · Updated 2025-12-11 · CVE-2025-63497

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions rickxy Hospital Management System version 1.0

Description The patient prescription viewing functionality within the his doc view single patient.php component contains an SQL injection issue. The pat number GET parameter is directly incorporated into SQL queries without sufficient sanitization. This allows authenticated attackers with the doctor role to execute arbitrary SQL queries. The vulnerable parameter is pat number.

Recommendations Apply proper sanitization to the pat number GET parameter before using it in SQL queries.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-63497

Affected Products

Rickxy Hospital Management System

References · 7

• 🔥 https://github.com/cristibtz/security-research/blob/main/CVE-2025-63497/report.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-63497 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63497 · Security Note
• https://github.com/cristibtz/security-research/tree/main/rickxy-Hospital-Management-System · Note
• https://twitter.com/CVEnew/status/1987936646713536969 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1987960764947198455 · Twitter Post
• https://t.me/cveNotify/145528 · Telegram Post