SourceCodester Hospital Management System 1.0 IDOR Allows Permanent Deletion of Any Patient Account

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Title: - SourceCodester Hospital Management System 1.0 Improper Access Controls 2. Vulnerability Description: - Insecure Direct Object References (IDOR) vulnerability in Hospital Management System 1.0 allows attackers to permanently delete any patient account. - Insecure Direct Object References (IDOR) vulnerability in the "Vaidya Mitra" healthcare Hospital Management System 1世, specifically in the patient's "Delete Account" feature. The issue arises due to broken access control on the ID parameter, allowing an attacker to delete any patient account permanently. 3. PoC (Proof of Concept) Steps: 1. Login as a patient 2. Go to 3. Attempt to delete the account and before confirming with yes, intercept the request in Burp Suite 4. Send the request POST to repeater in Burp Suite 5. Modify the id parameter value to that of another patient to delete their account permanently 4. PoC Video: - 5. Vulnerability Source: - 6. Submitter: - Salah Tayeh (UID 77272) 7. Submission Date: - 11/10/2024 02:02 AM (7 days ago) 8. Review Date: - 11/11/2024 09:28 AM (1 day later) 9. Status: - Accepted 10. VulDB Entry: - 283869 [SourceCodester Hospital Management System 1.0 delete-account.php id improper authorization] 11. Points: - 20 This information provides a detailed description of the vulnerability's nature, attack method, PoC steps, source, submitter, submission and review dates, as well as the VulDB entry and points awarded.

Goal Reached Thanks to every supporter — we hit 100%!

SourceCodester Hospital Management System 1.0 IDOR Allows Permanent Deletion of Any Patient Account