PT-2023-31460 · Unknown · Hospital Management System

Carlos Bello · Publicado 2023-09-28 · Atualizado 2023-12-19 · CVE-2023-5004

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hospital management system version 378c157

Description The Hospital management system is vulnerable to SQL injection (SQLI), which allows attackers to bypass authentication. This issue is related to a SQLI vulnerability in the application.

Recommendations For Hospital management system version 378c157, consider temporarily disabling or restricting access to the authentication mechanism until a patch is available. As a temporary workaround, restrict access to the vulnerable SQL queries to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-5004

Produtos afetados

Hospital Management System

Referências · 9

• 🔥 https://fluidattacks.com/advisories/alcocer · Exploit
• https://twitter.com/CVEnew/status/1707498665718300928 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1707524987651846563 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-5004 · Aviso do Fabricante
• https://twitter.com/fluidattacks/status/1735437511227318279 · Publicação no Twitter
• https://github.com/projectworldsofficial/hospital-management-system-in-php · Nota
• https://t.me/cibsecurity/71231 · Publicação no Telegram
• https://twitter.com/fluidattacks/status/1737224536347562473 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-5004 · Nota de Segurança