CVE-2024-51360

An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php file

Critical · published May 23, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
62.2
In the wild
Unconfirmed
What it is

🚨 A single misstep in a hospital management system could open the door to total chaos! 🔥 Think of it like a hospital's secure patient file room where an attacker finds a way to sneak in and access confidential records at will — incredibly dangerous for patient safety! If exploited, an attacker could execute any code they wish, potentially compromising sensitive patient data and system integrity. This means they could manipulate records, gain unauthorized access to personal information, or even disrupt hospital operations, leading to absolutely devastating consequences for patients and staff alike.

Put simply

Think of it like a hospital's secure patient file room where an attacker finds a way to sneak in and access confidential records at will — incredibly dangerous for patient safety! This critical vulnerability allows remote attackers to execute arbitrary code through the vulnerable edit-profile.php file in Hospital Management System V4.0, effectively bypassing security protocols.

What to do

If exploited, an attacker could execute any code they wish, potentially compromising sensitive patient data and system integrity. This means they could manipulate records, gain unauthorized access to personal information, or even disrupt hospital operations, leading to absolutely devastating consequences for patients and staff alike. Immediate action is essential! Update your Hospital Management System to the latest patched version. Additionally, consider implementing web application firewalls and monitoring for unusual activity in your system. You've got this! Follow these steps, and you'll secure your system like a pro! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00992 · 62.2th percentile
Published
2025-05-23T00:00Z
EPSS history
Timeline
  • 23 MAY 00:00Z
    An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php file
    cvelistv5