Campcodes Online Hospital Management System 1.0 · SQL Injection

Impact

For European organizations using the Campcodes OHMS 1.0, this SQL injection vulnerability poses significant risks to confidentiality, integrity, and availability of sensitive healthcare data. Attackers could extract patient records, administrative data, and other confidential information, violating GDPR and other data protection regulations. The ability to perform UNION-based queries and time-based blind injections means attackers can systematically enumerate database schema and contents, potentially leading to full database compromise. Integrity risks include unauthorized modification or deletion of records, which could disrupt hospital operations and patient care. Availability could be impacted if attackers execute resource-intensive queries causing denial of service. Given the healthcare context, such breaches could lead to reputational damage, regulatory fines, and harm to patient safety. Although no widespread exploitation is currently reported, the presence of public exploit code increases the likelihood of targeted attacks, especially against smaller hospitals or clinics with limited cybersecurity resources.