PT-2023-31460 · Unknown · Hospital Management System

Carlos Bello · Published 2023-09-28 · Updated 2023-12-19 · CVE-2023-5004

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hospital management system version 378c157

Description The Hospital management system is vulnerable to SQL injection (SQLI), which allows attackers to bypass authentication. This issue is related to a SQLI vulnerability in the application.

Recommendations For Hospital management system version 378c157, consider temporarily disabling or restricting access to the authentication mechanism until a patch is available. As a temporary workaround, restrict access to the vulnerable SQL queries to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-5004

Affected Products

Hospital Management System

References · 9

• 🔥 https://fluidattacks.com/advisories/alcocer · Exploit
• https://osv.dev/vulnerability/CVE-2023-5004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5004 · Security Note
• https://twitter.com/CVEnew/status/1707498665718300928 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1707524987651846563 · Twitter Post
• https://twitter.com/fluidattacks/status/1735437511227318279 · Twitter Post
• https://github.com/projectworldsofficial/hospital-management-system-in-php · Note
• https://t.me/cibsecurity/71231 · Telegram Post
• https://twitter.com/fluidattacks/status/1737224536347562473 · Twitter Post