CVE-2024-11073: mayurik hospital_management_system Incorrect Privilege Assignment

Vulnerability summary

CVE-2024-11073 is a high (CVSS 8.1) Incorrect Privilege Assignment vulnerability in mayurik hospital_management_system. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 45.9% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 11-11-2024
   PublishedVulnerability first disclosed.
2. 12-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability classified as problematic has been found in SourceCodester Hospital Management System 1.0. This affects an unknown part of the file /vm/patient/delete-account.php. The manipulation of the argument id leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

• CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.