PT-2026-20483 · Phpgurukul · Phpgurukul Hospital Management System

Published 2026-02-18 · Updated 2026-02-18 · CVE-2025-70063

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHPGurukul Hospital Management System version 4.0

Description The 'Medical History' module is susceptible to an Insecure Direct Object Reference (IDOR) issue. The application does not properly validate whether the requested viewid parameter corresponds to the currently logged-in patient. This allows a user to view the medical records of other patients by manipulating the viewid integer. The API endpoint involved is not explicitly mentioned.

Recommendations Ensure proper access control checks are implemented to verify that the viewid parameter belongs to the currently authenticated patient before granting access to medical records.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-70063

Affected Products

Phpgurukul Hospital Management System

References · 6

• 🔥 https://gist.github.com/Sanka1pp/f43c7eca5048152899e14412523afe80 · Exploit
• 🔥 https://packetstorm.news/files/id/213711 · Exploit
• https://osv.dev/vulnerability/CVE-2025-70063 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70063 · Security Note
• https://t.me/CVEtracker/45008 · Telegram Post
• https://twitter.com/CVEnew/status/2024258100522578368 · Twitter Post