Paper/Archive/CVE-2023-4181

CVE-2023-4181

SourceCodester Free Hospital Management System for Small Practices — SourceCodester Free Hospital Management System for Small Practices Redirect behavioral workflow

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 65.6.656 × 2013.1 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A vulnerability, which was classified as critical, has been found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this issue is some unknown functionality of the file /vm/admin/delete-doctor.php?id=2 of the component Redirect Handler. The manipulation leads to enforcement of behavioral workflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-236216.

Affected

ProductAffectedFixed inSource

Free Hospital Management System for Small Practices1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

VulDB (CNA)5.4CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

writeupvuldb.com/?id.236216 refvuldb.com/?ctiid.236216 exploitgithub.com/Yesec/Free-Hospital-Management-System-for-Small-Practices/blob/main/vertical%20privilege%20escalation/vuln.md