CVE-2023-5004

Summary

Hospital management system version 378c157 allows to bypass authentication.

This is possible because the application is vulnerable to SQLI.

Affected Software

Weaknesses

• CWE-89: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

ADP Enrichment

CVE Program Container

Additional References

• https://fluidattacks.com/advisories/alcocer
• https://github.com/projectworldsofficial/hospital-management-system-in-php/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: total

References

• https://fluidattacks.com/advisories/alcocer
• https://github.com/projectworldsofficial/hospital-management-system-in-php/

• ←Previous
• Next→