CVE-2024-28320
Last modified
CVE-2024-28320 is a high-severity vulnerability rated 7.6/10 on the CVSS scale. Insecure Direct Object References (IDOR) vulnerability in Hospital Management System 1.0 allows attackers to manipulate user parameters for unauthorized access and modifications via crafted POST request to /patient/edit-user.php.. EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
Insecure Direct Object References (IDOR) vulnerability in Hospital Management System 1.0 allows attackers to manipulate user parameters for unauthorized access and modifications via crafted POST request to /patient/edit-user.php.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mayurik | Hospital Management System | 1.0 |
References
- https://sospiro014.github.io/Hospital-Management-System-1.0-Insecure-Direct-Object-Reference-+-Account-TakeoverExploit, Third Party Advisory
- https://sospiro014.github.io/Hospital-Management-System-1.0-Insecure-Direct-Object-Reference-+-Account-TakeoverExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-28320?
How severe is CVE-2024-28320?
How do I fix CVE-2024-28320?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-2830The WordPress Tag and Category Manager – AI Autotagger plugi…6.4
- CVE-2024-28303Open Source Medicine Ordering System v1.0 was discovered to …9.8
- CVE-2024-2831The Calendar plugin for WordPress is vulnerable to SQL Injec…8.8
- CVE-2024-28318gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to cont…7.1
- CVE-2024-28319gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to cont…6.2
- CVE-2024-2832A vulnerability classified as problematic was found in Campc…6.1
- CVE-2024-28322SQL Injection vulnerability in /event-management-master/back…9.8
- CVE-2024-28323The bwdates-report-result.php file in Phpgurukul User Regist…6.5
- CVE-2024-28325Asus RT-N12+ B1 router stores credentials in cleartext, whic…6.1
- CVE-2024-28326Incorrect Access Control in ASUS RT-N12+ B1 and RT-N12 D1 ro…6.8
- CVE-2024-28327Asus RT-N12+ B1 router stores user passwords in plaintext, w…8.4
- CVE-2024-28328CSV Injection vulnerability in the Asus RT-N12+ router allow…5.4
Are you affected by CVE-2024-28320?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST