CVE-2025-65340 identifies a critical SQL Injection vulnerability (CWE-89) in kishan0725 Hospital Management System 4.0, specifically in the /betweendates-detailsreports.php script. The flaw allows remote attackers to inject malicious SQL queries without authentication, resulting in high impact on confidentiality, integrity, and availability. The vulnerability is publicly known but no official fix or mitigation has been published yet. No known exploits in the wild have been reported as of the publication date.

Successful exploitation can lead to unauthorized data access, data modification, or deletion, and potentially full system compromise due to the ability to execute arbitrary SQL commands. The vulnerability affects core functionality related to report generation, which may expose sensitive patient or hospital data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply web application firewalls or input validation controls to mitigate SQL injection risks. Monitor vendor channels for updates and apply patches promptly once released.