PT-2022-15712 · Unknown · Hospital'S Patient Records Management System

Published 2022-02-14 · Updated 2022-03-30 · CVE-2022-22854

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hospital Patient Record Management System version 1.0

Description The issue is related to an access control problem in the hprms/admin/?page=user/list endpoint of the Hospital Patient Record Management System, allowing attackers to escalate privileges by accessing and editing the user list.

Recommendations For Hospital Patient Record Management System version 1.0, consider restricting access to the hprms/admin/?page=user/list endpoint until a patch is available. As a temporary workaround, limit the ability to edit the user list to authorized personnel only. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-22854

Affected Products

Hospital'S Patient Records Management System

References · 5

• 🔥 https://github.com/Dheeraj-Deshmukh/Hospital-s-patient-management-system · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-22854 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22854 · Vendor Advisory
• https://t.me/cvenotify/27177 · Telegram Post
• https://t.me/cibsecurity/37435 · Telegram Post