VulnerabilityAnalyzed

CVE-2025-70063

The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability.

MEDIUM 6.5EPSS 0.34%

Does this matter?

Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.

Description

The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability. The application fails to verify that the requested 'viewid' parameter belongs to the currently authenticated patient. This allows a user to access the confidential medical records of other patients by iterating the 'viewid' integer.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.34% probability · 27th percentile
CISA KEV: Not listed
Weakness: CWE-639
Affected: phpgurukul/hospital management system
Source: cve@mitre.org

References

https://gist.github.com/Sanka1pp/f43c7eca5048152899e14412523afe80Exploit, Third Party Advisory
https://packetstorm.news/files/id/213711Exploit, Mitigation, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.