Hospitals patient records management system 1.0 account takeover Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2022-01-05 |
Type : webapps |
Platform : php
This exploit / vulnerability Hospitals patient records management system 1.0 account takeover is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: Hospitals Patient Records Management System 1.0 - Account TakeOver
# Date: 30/12/2021
# Exploit Author: twseptian
# Vendor Homepage: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/hprms_0.zip
# Version: v1.0
# Tested on: Kali Linux 2021.4
*Insecure direct object references (IDOR)*
Insecure Direct Object References (IDOR) occur when an application provides direct access to objects based on user-supplied input.Insecure Direct Object References allow attackers to bypass authorization and access resources directly by modifying the value of a parameter used to directly point to an object. Such resources can be database entries belonging to other users, files in the system.
*Attack Vector*
An attacker can takeover the Administrator's account
*Steps of reproduce:*
Note: in this case, we used two users, user1 as a staff with user id '4', and admin as an Administrator with user id '1'.