CVE-2020-22165
About
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
Rainforest analyst review
This is an unauthenticated SQL injection in the login page of PHPGurukul's Hospital Management System, and the impact is confidentiality: a remote attacker with no credentials can extract sensitive data straight from the database. The vector confirms no integrity or availability impact, so the threat model is data theft.
Unauthenticated SQLi in a small PHP application is trivially automated, and login pages are the first thing any scanner pokes. The kind of data such a system holds makes the confidentiality loss meaningful even without code execution.
Applications like this rarely appear in any central inventory, so our angle is discovery and reachability: figuring out whether this software is running anywhere and whether the vulnerable endpoint answers from an untrusted network. The score should be read through that exposure lens rather than taken as an automatic top priority.
References
Related CVEs
Frequently asked questions
What is CVE-2020-22165?
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
How severe is CVE-2020-22165?
CVE-2020-22165 carries a CVSS 3.1 base score of 7.5, rated high. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 75 out of 100, in the high band.
How is CVE-2020-22165 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity None and availability None.
Which products are affected by CVE-2020-22165?
Public advisories list the following as affected: hospital management system. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2020-22165?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.