PT-2026-20481 · Phpgurukul · Phpgurukul Hospital Management System
CVE-2025-70062
·
Publicado
2026-02-18
·
Atualizado
2026-02-23
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
PHPGurukul Hospital Management System version 4.0
Description
The application does not properly validate CSRF tokens on the
add-doctor.php endpoint, specifically within the 'Add Doctor' module. This allows attackers to create new Doctor accounts, potentially with administrative privileges, by deceiving an authenticated administrator into visiting a malicious webpage. The vulnerability is a Cross-Site Request Forgery (CSRF) issue.Recommendations
Ensure CSRF token validation is implemented and enforced on the
add-doctor.php endpoint.Exploit
Correção
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Phpgurukul Hospital Management System