PT-2024-16737 · Sourcecodester · Sourcecodester Hospital Management System

Salah Tayeh · Published 2024-11-11 · Updated 2024-11-18 · CVE-2024-11073

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Hospital Management System version 1.0

Description A vulnerability has been found in the SourceCodester Hospital Management System, affecting an unknown part of the file /vm/patient/delete-account.php. The manipulation of the id argument leads to improper authorization, allowing for remote attacks. This issue can lead to unauthorized deletion of patient accounts.

Recommendations Update to the latest version of the SourceCodester Hospital Management System to mitigate risks. As a temporary workaround, consider restricting access to the /vm/patient/delete-account.php endpoint until a patch is available. Review access controls to prevent unauthorized actions.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

IDOR

Weakness Enumeration

CWE-285

CWE-266

CWE-639

Related Identifiers

CVE-2024-11073

Affected Products

Sourcecodester Hospital Management System

References · 25

• 🔥 https://vuldb.com/?submit.440799 · Exploit
• 🔥 https://drive.google.com/file/d/1yFo0re8taTry7oR4-EDg3UHwO2lkqO9N/view?usp=sharing · Exploit
• 🔥 https://github.com/Salah-Tayeh/CVEs-and-Vulnerabilities/blob/main/Hospital%20Management%20System%20-%20IDOR%20Causing%20Deletion%20of%20any%20patient%20account.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-11073 · Security Note
• https://osv.dev/vulnerability/CVE-2024-11073 · Vendor Advisory
• https://twitter.com/transilienceai/status/1857478608987799819 · Twitter Post
• https://twitter.com/transilienceai/status/1857478662993621307 · Twitter Post
• https://twitter.com/transilienceai/status/1857478650129678619 · Twitter Post
• https://twitter.com/CVEnew/status/1856022658644627791 · Twitter Post
• https://sourcecodester.com · Note
• https://twitter.com/transilienceai/status/1857291835305009569 · Twitter Post
• https://twitter.com/transilienceai/status/1857291858281427403 · Twitter Post
• https://vuldb.com/?ctiid.283869 · Note
• https://twitter.com/transilienceai/status/1857291827050594558 · Twitter Post
• https://twitter.com/transilienceai/status/1857291869975179569 · Twitter Post