CVE-2025-56212 identifies a SQL Injection vulnerability in the phpgurukul Hospital Management System version 4.0. The flaw exists in the add-doctor.php file where the docname parameter is not properly sanitized, allowing remote attackers to inject malicious SQL queries. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to unauthorized data disclosure, modification, or deletion within the hospital management system's database. This could compromise sensitive patient and hospital data, disrupt system operations, and potentially allow further system compromise.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to apply web application firewalls or input validation controls to block malicious SQL payloads targeting the docname parameter.