CVE-2025-70063

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-70063

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

T

he 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability. The application fails to verify that the requested 'viewid' parameter belongs to the currently authenticated patient. This allows a user to access the confidential medical records of other patients by iterating the 'viewid' integer.

References
Link Resource
https://gist.github.com/Sanka1pp/f43c7eca5048152899e14412523afe80 Exploit Third Party Advisory
https://packetstorm.news/files/id/213711 Exploit Mitigation Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:phpgurukul:hospital_management_system:4.0:*:*:*:*:*:*:*
History

26 Feb 2026, 22:33

Type Values Removed Values Added
First Time Phpgurukul hospital Management System
Phpgurukul
Summary
  • (es) El módulo 'Medical History' en PHPGurukul Hospital Management System v4.0 contiene una vulnerabilidad de Referencia Directa Insegura a Objeto (IDOR). La aplicación no verifica que el parámetro 'viewid' solicitado pertenezca al paciente actualmente autenticado. Esto permite a un usuario acceder a los registros médicos confidenciales de otros pacientes al iterar el entero 'viewid'.
CPE cpe:2.3:a:phpgurukul:hospital_management_system:4.0:*:*:*:*:*:*:*
References () https://gist.github.com/Sanka1pp/f43c7eca5048152899e14412523afe80 - () https://gist.github.com/Sanka1pp/f43c7eca5048152899e14412523afe80 - Exploit, Third Party Advisory
References () https://packetstorm.news/files/id/213711 - () https://packetstorm.news/files/id/213711 - Exploit, Mitigation, Third Party Advisory

18 Feb 2026, 20:18

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CWE CWE-639

18 Feb 2026, 19:21

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-18 19:21

Updated : 2026-02-26 22:33

NVD link : CVE-2025-70063

Mitre link : CVE-2025-70063

CVE.ORG link : CVE-2025-70063

JSON object : View

Products Affected

phpgurukul

CWE
CWE-639

Authorization Bypass Through User-Controlled Key