CVE-2020-35745

Опубликовано: 07 янв. 2021

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, doctors, patients, change admin password, get appointment history and access all session logs.

Ссылки

https://medium.com/%40ashketchum/privilege-escalation-unauthenticated-access-to-admin-portal-cve-2020-35745-bb5d5dca97a0
Exploit
Third Party Advisory
https://www.phpgurukul.com/hospital-management-system-in-php/
Product
Third Party Advisory
https://www.youtube.com/watch?v=vnSsg6iwV9Y&feature=youtu.be&ab_channel=ashketchum
Exploit
Third Party Advisory
https://medium.com/%40ashketchum/privilege-escalation-unauthenticated-access-to-admin-portal-cve-2020-35745-bb5d5dca97a0
Exploit
Third Party Advisory
https://www.phpgurukul.com/hospital-management-system-in-php/
Product
Third Party Advisory
https://www.youtube.com/watch?v=vnSsg6iwV9Y&feature=youtu.be&ab_channel=ashketchum
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:phpgurukul:hospital_management_system:4.0:*:*:*:*:*:*:*

EPSS

Процентиль: 59%

0.00379

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-862

Связанные уязвимости

GHSA-3rv3-jp5p-3jhw