CVE-2025-70063
IDOR Vulnerability in PHPGurukul Medical History Module Enables Data Exposure
Publication date: 2026-02-18
Last updated on: 2026-02-26
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| phpgurukul | hospital_management_system | 4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "The vulnerability is an Insecure Direct Object Reference (IDOR) in the 'Medical History' module of PHPGurukul Hospital Management System version 4.0."}, {'type': 'paragraph', 'content': "Specifically, the application does not verify that the 'viewid' parameter in the URL belongs to the currently authenticated patient."}, {'type': 'paragraph', 'content': "This means that an authenticated user can change the 'viewid' integer in the URL to access confidential medical records of other patients without authorization."}, {'type': 'paragraph', 'content': 'The flaw arises from a lack of session-based access control rather than input sanitization issues.'}] [1]
How can this vulnerability impact me? :
This vulnerability allows unauthorized users to access confidential medical records (Protected Health Information) of other patients.
Such unauthorized access can lead to privacy breaches, exposure of sensitive health information, and potential misuse of that data.
It compromises patient confidentiality and trust in the hospital management system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by testing the 'Medical History' module of the PHPGurukul Hospital Management System v4.0 for Insecure Direct Object Reference (IDOR) issues. Specifically, after logging in as a patient, you can observe the URL parameter 'viewid' when accessing medical records."}, {'type': 'paragraph', 'content': "To detect the vulnerability, try modifying the 'viewid' parameter in the URL to another integer value corresponding to a different patient ID. If the system returns medical records of other patients without proper authorization, the vulnerability exists."}, {'type': 'list_item', 'content': 'Log in as a patient user.'}, {'type': 'list_item', 'content': "Navigate to the 'Medical History' section and note the URL parameter 'viewid'."}, {'type': 'list_item', 'content': 'Use a tool like curl or a browser to change the \'viewid\' parameter to another value, for example: curl -b cookies.txt "http://target/medical_history.php?viewid=11"'}, {'type': 'list_item', 'content': 'Check if the response contains medical records of a different patient.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': "Immediate mitigation steps include implementing proper access control checks on the server side to verify that the 'viewid' parameter belongs to the currently authenticated patient before returning any medical records."}, {'type': 'paragraph', 'content': 'Ensure that the application enforces session-based authorization and does not rely solely on input sanitization to protect sensitive data.'}, {'type': 'list_item', 'content': "Modify the backend code to validate that the requested 'viewid' matches the authenticated user's ID."}, {'type': 'list_item', 'content': 'Restrict direct access to medical records by verifying user permissions on every request.'}, {'type': 'list_item', 'content': 'If possible, apply patches or updates from the vendor addressing this vulnerability.'}, {'type': 'list_item', 'content': "Monitor access logs for suspicious activity involving manipulation of the 'viewid' parameter."}] [1]