LiveActive security incident?Get immediate response
CVE Record

CVE-2020-22173: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\edit-profile.php.

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\edit-profile.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This CVE describes a SQL injection flaw in PHPGurukul Hospital Management System in PHP v4.0. The source says unauthenticated remote users may obtain sensitive database information. Evidence is sparse: no CVSS score, CPE data, vendor advisory, or named patch is provided.

Executive priority

Prioritize identification and containment if this software is in use, especially in internet-facing healthcare environments. The business risk is sensitive database exposure, but confidence is limited by sparse public metadata.

Technical view

The vulnerability is reported in hms/edit-profile.php and is described as SQL injection. The provided CVE data indicates remote unauthenticated access could expose database-sensitive information. The bundle does not include CWE mapping, affected CPEs, exploit maturity details, or remediation instructions.

Likely exposure

Exposure appears limited to deployments of PHPGurukul Hospital Management System in PHP v4.0 where hms/edit-profile.php is reachable. The CVE record does not confirm other affected versions or products.

Exploitation context

A public GitHub reference is cited, indicating public disclosure material exists. The source bundle does not prove active exploitation, and KEV is false, so exploitation in the wild should be treated as unconfirmed.

Researcher notes

The record lacks CVSS, CWE, CPE, and vendor remediation details. Avoid assuming broader version impact. Focus validation on confirmed v4.0 deployments and the named edit-profile.php component.

Mitigation direction

  • Check PHPGurukul or project maintainer guidance for an official fixed version or patch.
  • Restrict internet access to the hospital management application until remediation is confirmed.
  • Require authentication and trusted network access for administrative or profile-management paths.
  • Review database permissions used by the application and reduce unnecessary read access.
  • Monitor application and database logs for unusual profile-edit or query-related activity.

Validation and detection

  • Inventory systems running PHPGurukul Hospital Management System in PHP v4.0.
  • Confirm whether hms/edit-profile.php is deployed and externally reachable.
  • Review application code or vendor updates for parameterized query handling in the affected path.
  • Check logs for suspicious requests targeting profile-edit functionality.
  • Document compensating controls if no vendor patch is available.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-22173 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.