CVE-2025-56214 identifies a critical SQL Injection vulnerability in phpgurukul Hospital Management System version 4.0. The vulnerability exists in the index.php script where the username parameter is not properly sanitized, allowing remote attackers to inject malicious SQL queries. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information provided at this time.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data disclosure, data modification, or deletion, and potentially full system compromise. The critical CVSS score indicates a severe impact on the affected system's security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the username parameter. Avoid exposing the vulnerable interface to untrusted networks if possible.