The kishan0725 Hospital Management System 4.0 is affected by a SQL Injection vulnerability identified as CVE-2025-69944. The flaw exists in the view-medhistory.php endpoint where the viewid parameter is not properly sanitized, allowing an attacker to inject SQL code. This can lead to unauthorized access or manipulation of the backend database. The vulnerability is remotely exploitable without authentication and requires low attack complexity. No known exploits are reported in the wild, and no vendor advisory or patch information is currently provided.

Successful exploitation can result in unauthorized disclosure of sensitive patient data, alteration of medical records, or disruption of system availability. The vulnerability affects confidentiality, integrity, and availability of the system as indicated by the CVSS vector (C:L/I:L/A:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the viewid parameter.