CVE-2025-56216 identifies an SQL Injection vulnerability in phpgurukul Hospital Management System 4.0, specifically in the about-us.php script through the pagetitle parameter. The vulnerability allows an attacker with low privileges and no user interaction to execute crafted SQL commands remotely over the network. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and significant confidentiality impact. No known exploits in the wild or patch information are currently documented.

Successful exploitation could allow an attacker to read sensitive database information, impacting confidentiality severely. Integrity is not impacted according to the CVSS vector, and availability impact is low. The vulnerability requires low privileges but no user interaction, increasing the risk in environments where authenticated access is possible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the about-us.php page and validate or sanitize the pagetitle parameter input to mitigate SQL Injection risks.