PT-2026-20484 · Phpgurukul · Phpgurukul Hospital Management System

CVE-2025-70064 · Publicado 2026-02-18 · Atualizado 2026-02-23

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPGurukul Hospital Management System version 4.0

Description PHPGurukul Hospital Management System version 4.0 contains a privilege escalation issue. A low-privileged user, such as a Patient, can access the Administrator Dashboard and its sub-modules, including User Logs and Doctor Management, by directly navigating to the /admin/ directory after authentication. This allows a self-registered user to gain control of the application, view sensitive logs, and alter system data. The vulnerable component is the access control mechanism that allows unauthorized access to administrative functions.

Recommendations Restrict access to the /admin/ directory to authorized users only.

Exploit

Correção

LPE

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2025-70064

Produtos afetados

Phpgurukul Hospital Management System

Referências · 8

• 🔥 https://packetstorm.news/files/id/213711 · Exploit
• 🔥 https://gist.github.com/Sanka1pp/c6f20cd6db1fbb1f0e7e199ead66691d · Exploit
• https://twitter.com/CVEnew/status/2024258101449543877 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2024218127819821567 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-70064 · Aviso do Fabricante
• https://t.me/cveNotify/152939 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-70064 · Nota de Segurança
• https://t.me/CVEtracker/45009 · Publicação no Telegram