CVE-2026-40550— Privilege Escalation in mpGabinet

Privilege Escalation in mpGabinet

mpGabinet is vulnerable to Privilege Escalation due to excessive database privileges assigned to the user used by the application. An attacker with access to any running application instance connected to the backend server can extract database credentials from the application’s memory by inspecting the running process. While ability to retrieve credentials from memory is expected behavior, the exposed credentials grant administrative access to the database, exceeding the privileges required for normal application functionality. This allows an attacker to perform actions beyond those permitted through the application interface. This issue affects mpGabinet version 23.12.19 and below.

N/A

带着不必要的权限执行

BinSoft mpGabinet 安全漏洞

BinSoft mpGabinet是波兰BinSoft公司的一个医疗诊所管理系统。 BinSoft mpGabinet 23.12.19及之前版本存在安全漏洞，该漏洞源于分配给应用程序的用户数据库权限过高，可能导致攻击者通过检查运行进程从应用程序内存中提取数据库凭据，获取数据库管理访问权限，执行超出应用程序接口允许的操作。

N/A

N/A