CVE-2020-35745 — Missing Authorization in Hospital Management System

CWE-862 — Missing AuthorizationCWE-269 — Improper Privilege Management3 documents3 sources
Severity
8.8HIGHNVD
EPSS
0.4%
top 40.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Phpgurukul Hospital Management System
Timeline
PublishedJan 7
Latest updateMay 24

Description

PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, doctors, patients, change admin password, get appointment history and access all session logs.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-3rv3-jp5p-3jhw: PHPGURUKUL Hospital Management System V 4↗2022-05-24
▶
CVEList
CVE-2020-35745: PHPGURUKUL Hospital Management System V 4↗2021-01-07
▶
CVE-2020-35745 — Missing Authorization | cvebase