PT-2024-31869 · Unknown · Hospital Management System

Sourajeet Majumder · Published 2024-09-26 · Updated 2024-09-30 · CVE-2024-45983

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions kishan0725's Hospital Management System version 6.3.5

Description A Cross-Site Request Forgery (CSRF) issue exists, allowing an attacker to craft a malicious HTML form that submits a request to delete a doctor record. By enticing an authenticated admin user to visit the specially crafted web page, the attacker can leverage the victim's browser to make unauthorized requests to the vulnerable endpoint, effectively allowing the attacker to perform actions on behalf of the admin without their consent.

Recommendations For version 6.3.5, consider implementing proper CSRF protection mechanisms, such as token-based validation, to prevent unauthorized requests. As a temporary workaround, restrict access to the doctor record deletion functionality to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-45983

Affected Products

Hospital Management System

References · 6

• 🔥 https://github.com/soursec/CVEs/tree/main/CVE-2024-45983 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45983 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45983 · Vendor Advisory
• https://t.me/cvedetector/6424 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1839399337534587230 · Twitter Post
• https://twitter.com/CVEnew/status/1839332005491941529 · Twitter Post