CVE-2024-11073
📋 TL;DR
This CVE describes an Insecure Direct Object Reference (IDOR) vulnerability in SourceCodester Hospital Management System 1.0. Attackers can remotely delete any patient account by manipulating the 'id' parameter in the /vm/patient/delete-account.php file without proper authorization checks. All deployments of this specific software version are affected.
💻 Affected Systems
- SourceCodester Hospital Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Mass deletion of all patient records, causing complete data loss and service disruption in hospital operations.
Likely Case
Targeted deletion of specific patient accounts, potentially for extortion, sabotage, or covering up medical fraud.
If Mitigated
Unauthorized deletion attempts are logged and blocked, with minimal impact on legitimate operations.
🎯 Exploit Status
Exploit requires authentication but bypasses authorization checks. Public GitHub repository contains detailed exploitation methodology.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider implementing custom fixes or migrating to alternative software.
🔧 Temporary Workarounds
Implement Proper Authorization Checks
allAdd server-side authorization validation to ensure users can only delete their own accounts or accounts they're authorized to manage.
Modify /vm/patient/delete-account.php to include session validation and user permission checks before processing deletion
Web Application Firewall Rule
allBlock suspicious delete-account.php requests with manipulated ID parameters.
WAF rule: Block requests to /vm/patient/delete-account.php where id parameter doesn't match current user's authorized patient IDs
🧯 If You Can't Patch
- Implement network segmentation to restrict access to the Hospital Management System from untrusted networks.
- Enable detailed logging of all delete-account.php requests and implement real-time alerting for suspicious deletion patterns.
🔍 How to Verify
Check if Vulnerable:
Test by logging in as one user and attempting to delete another user's account by modifying the 'id' parameter in delete-account.php requests.Check Version:
Check application version in admin panel or review source code comments for version information.Verify Fix Applied:
After implementing authorization checks, verify that users can only delete their own accounts or accounts they're explicitly authorized to manage.📡 Detection & Monitoring
Log Indicators:
- Multiple DELETE requests to /vm/patient/delete-account.php with different id parameters from same user session
- Rapid succession of account deletion requests
Network Indicators:
- HTTP POST requests to /vm/patient/delete-account.php with manipulated id parameters
- Unusual patterns of account deletion activity
SIEM Query:
source="web_server_logs" AND uri_path="/vm/patient/delete-account.php" AND (id_parameter_changes > threshold OR deletion_rate > normal)🔗 References
- https://drive.google.com/file/d/1yFo0re8taTry7oR4-EDg3UHwO2lkqO9N/view?usp=sharing
- https://github.com/Salah-Tayeh/CVEs-and-Vulnerabilities/blob/main/Hospital%20Management%20System%20-%20IDOR%20Causing%20Deletion%20of%20any%20patient%20account.md
- https://vuldb.com/?ctiid.283869
- https://vuldb.com/?id.283869
- https://vuldb.com/?submit.440799
- https://www.sourcecodester.com/
