CVE-2024-45983

A Cross-Site Request Forgery (CSRF) vulnerability exists in kishan0725's Hospital Management System version 6.3.5. The vulnerability allows an attacker to craft a malicious HTML form that submits a request to delete a doctor record. By enticing an authenticated admin user to visit the specially crafted web page, the attacker can leverage the victim's browser to make unauthorized requests to the vulnerable endpoint, effectively allowing the attacker to perform actions on behalf of the admin without their consent.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/soursec/CVEs/tree/main/CVE-2024-45983	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:kishan0725:hospital_management_system:6.3.5:*:*:*:*:*:*:*

History

16 May 2025, 20:29

Type	Values Removed	Values Added
References	~~() https://github.com/soursec/CVEs/tree/main/CVE-2024-45983 -~~	() https://github.com/soursec/CVEs/tree/main/CVE-2024-45983 - Exploit, Third Party Advisory
CPE		cpe:2.3:a:kishan0725:hospital_management_system:6.3.5:::::::*
First Time		Kishan0725 hospital Management System Kishan0725

26 Sep 2024, 19:35

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-26 16:15

Updated : 2025-05-16 20:29

NVD link : CVE-2024-45983

Mitre link : CVE-2024-45983

CVE.ORG link : CVE-2024-45983

JSON object : View

Products Affected

kishan0725

hospital_management_system

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2024-45983", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2024-09-26T16:15:08.653", "references": [{"url": "https://github.com/soursec/CVEs/tree/main/CVE-2024-45983", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "A Cross-Site Request Forgery (CSRF) vulnerability exists in kishan0725's Hospital Management System version 6.3.5. The vulnerability allows an attacker to craft a malicious HTML form that submits a request to delete a doctor record. By enticing an authenticated admin user to visit the specially crafted web page, the attacker can leverage the victim's browser to make unauthorized requests to the vulnerable endpoint, effectively allowing the attacker to perform actions on behalf of the admin without their consent."}, {"lang": "es", "value": "Existe una vulnerabilidad de Cross-Site Request Forgery (CSRF) en kishan0725's Hospital Management System version 6.3.5. La vulnerabilidad permite a un atacante crear un formulario HTML malicioso que env\u00eda una solicitud para eliminar un registro m\u00e9dico. Al incitar a un usuario administrador autenticado a visitar la p\u00e1gina web especialmente manipulada, el atacante puede aprovechar el navegador de la v\u00edctima para realizar solicitudes no autorizadas al endpoint vulnerable, lo que le permite realizar acciones en nombre del administrador sin su consentimiento."}], "lastModified": "2025-05-16T20:29:29.833", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kishan0725:hospital_management_system:6.3.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A42416B-46B6-4845-9398-A389C9006C2A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}