PT-2022-23258 · Unknown · Doctor Appointment System

Published 2022-08-31 · Updated 2024-02-14 · CVE-2022-36202

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Doctor's Appointment System version 1.0

Description The issue concerns Incorrect Access Control, specifically Broken Access Control (IDOR), in the settings.php file located at the /edoc/patient/ endpoint. The vulnerability is exploited via the id parameter.

Recommendations For Doctor's Appointment System version 1.0, consider restricting access to the settings.php file to minimize the risk of exploitation. As a temporary workaround, avoid using the id parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-36202

Affected Products

Doctor Appointment System

References · 6

• 🔥 https://github.com/aznull/CVEs · Exploit
• https://osv.dev/vulnerability/CVE-2022-36202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36202 · Security Note
• https://t.me/cvenotify/35560 · Telegram Post
• https://sourcecodester.com/hashenudara/simple-doctors-appointment-project.html · Note
• http://hshnudr.com · Note