-orange){kind=icon}
"Featured Publication: Jan 2026" — Packet Storm Security"
| Advisory Property | Details |
|---|---|
| Vendor | PHPGurukul |
| Product | Hospital Management System (HMS) |
| Version | 4.0 |
| Vulnerability Count | 6 |
| Status | Unpatched (0-Day) |
| Date | January 2026 |
Syntropy Security has identified six (3 Critical + 3 High) security vulnerabilities in the PHPGurukul Hospital Management System v4.0. These vulnerabilities fundamentally compromise the confidentiality, integrity, and availability of the application. The flaws allow unauthenticated remote attackers to extract the complete database, bypass administrative authentication mechanisms, and access Protected Health Information (PHI) of patients.
Due to the severity of these findings (including Remote Account Takeover and Full Database Disclosure), immediate remediation is recommended.
The technical evidence for these findings is distributed across a comprehensive PDF report, specific exploit scripts, and video demonstrations.
| Vulnerability Type | Severity | CVE ID | Proof Artifacts & Documentation |
|---|---|---|---|
| Unauthenticated SQL Injection (Endpoint: get_doctor.php) |
Critical | Pending | • PDF Report (Page 2) |
| Admin Authentication Bypass (SQLi) (Endpoint: Admin Login) |
Critical | Pending | • PDF Report (Page 7) |
| Broken Access Control (RBAC) (Patient to Admin Escalation) |
Critical | Pending | • Exploit Code (RBAC_Privilege_Escalation.txt) |
| Cross-Site Request Forgery (CSRF) (Privileged Account Creation) |
High | CVE-2025-70062 | • Exploit Code (CSRF_Add_Doctor.txt) • Video Demonstration |
| Insecure Direct Object Reference (IDOR) (Access to Patient Records) |
High | CVE-2025-70063 | • PDF Report (Page 2) • Video Demonstration |
| Stored Cross-Site Scripting (XSS) (Account Takeover) |
High | CVE-2025-70064 | • PDF Report (Page 6) • Video Demonstration |
The application fails to parameterize user input in critical authentication and data retrieval endpoints. Specifically, the get_doctor.php endpoint allows unauthenticated XPATH injection, and the administrative login portal allows tautology-based authentication bypass (' OR '1'='1).
The application relies on obscure URLs rather than session-based Role-Based Access Control (RBAC). Low-privileged users can access administrative views by forcibly browsing to the /admin/ directory. Furthermore, the application fails to validate object ownership, allowing authenticated patients to iterate through the viewid parameter to access the medical history of other users (IDOR).
The application lacks Anti-CSRF tokens on state-changing requests, allowing attackers to forge requests that create privileged accounts. Additionally, user input is stored and rendered without encoding, leading to Stored XSS that facilitates session hijacking.
The vendor has not released a patch at the time of this disclosure. Administrators are advised to:
- Network Isolation: Restrict access to the administrative panel to trusted IP addresses only.
- Web Application Firewall (WAF): Deploy rules to block common SQL injection patterns (e.g.,
UNION SELECT,OR 1=1) and XSS payloads (<script>,javascript:). - Code Revision:
- Implement Prepared Statements (PDO) for all database queries.
- Enforce
session_start()and role verification checks at the top of every PHP file in the/admin/directory. - Implement anti-CSRF tokens on all POST forms.
Research & Discovery: Sankalp Devidas Hanwate Organization: Syntropy Security
Permanent Link: Packet Storm Security Advisory
Researcher: Sankalp Devidas Hanwate (Syntropy Security)
License: Educational Use / Responsible Disclosure
To leverage this research for penetration testing or security training, please link back to this repository.