CVE-2025-69944

This is a SQL injection in view-medhistory.php, specifically in the viewid parameter. The endpoint retrieves patient medical history records, and the vulnerability stems from directly interpolating the $_GET['viewid'] parameter into a SELECT query without any parameterization or escaping. The dangerous misconception here is treating 'read-only' queries as safe. A SELECT statement can still exfiltrate entire database contents through UNION-based injection, and in a medical context the blast radius is severe — patient treatment histories, diagnoses, and personal health information become directly accessible to the attacker. What to check: locate view-medhistory.php and examine how viewid is handled. If you see string concatenation with $_GET['viewid'] or $_REQUEST['viewid'] directly in the query string, you have this vulnerability. The fix requires switching to prepared statements — either mysqli_prepare() or PDO with parameter binding. Do not attempt to fix this with input filtering, WAF rules, or addslashes(); those are bypassable mitigations that leave the underlying code smell intact. The healthcare context changes the risk calculus. Medical records cannot be rotated like compromised passwords — leaked mental health diagnoses or treatment histories remain weaponizable indefinitely. This means the window between vulnerability introduction and patch deployment has a longer half-life of damage than in typical web applications. Prioritize patching aggressively, and audit any secondary systems that consume the query output (logging, caching, patient portals) for exposure escalation. If you're maintaining a fork or derivative of this codebase, check the entire patient record retrieval path — other view-*.php files in similar projects often share the same pattern. Parameterization should be the baseline expectation for all database queries, regardless of whether they read or write data.

Reviewed through automated stages and approved by a human before publication.