PT-2026-20484 · Phpgurukul · Phpgurukul Hospital Management System

Published 2026-02-18 · Updated 2026-02-23 · CVE-2025-70064

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPGurukul Hospital Management System version 4.0

Description PHPGurukul Hospital Management System version 4.0 contains a privilege escalation issue. A low-privileged user, such as a Patient, can access the Administrator Dashboard and its sub-modules, including User Logs and Doctor Management, by directly navigating to the /admin/ directory after authentication. This allows a self-registered user to gain control of the application, view sensitive logs, and alter system data. The vulnerable component is the access control mechanism that allows unauthorized access to administrative functions.

Recommendations Restrict access to the /admin/ directory to authorized users only.

Exploit

Fix

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-70064

Affected Products

Phpgurukul Hospital Management System

References · 8

• 🔥 https://packetstorm.news/files/id/213711 · Exploit
• 🔥 https://gist.github.com/Sanka1pp/c6f20cd6db1fbb1f0e7e199ead66691d · Exploit
• https://osv.dev/vulnerability/CVE-2025-70064 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70064 · Security Note
• https://twitter.com/CVEnew/status/2024258101449543877 · Twitter Post
• https://twitter.com/TheHackerWire/status/2024218127819821567 · Twitter Post
• https://t.me/cveNotify/152939 · Telegram Post
• https://t.me/CVEtracker/45009 · Telegram Post