CVE-2025-70064
Published: 18 February 2026
Description
PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. A low-privileged user (Patient) can directly access the Administrator Dashboard and all sub-modules (e.g., User Logs, Doctor Management) by manually browsing to the /admin/ directory after authentication. This allows any…
more
self-registered user to takeover the application, view confidential logs, and modify system data.
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for logical access, directly preventing low-privileged patients from accessing the /admin/ directory and sub-modules.
Implements least privilege to ensure patient accounts cannot access or takeover administrative functions.
Requires determination and authorization of access to resources like the admin dashboard prior to granting, addressing improper access control decisions.
Security SummaryAI
CVE-2025-70064 is a privilege escalation vulnerability in PHPGurukul Hospital Management System version 4.0. It allows a low-privileged user, such as a patient, to directly access the Administrator Dashboard and all associated sub-modules, including User Logs and Doctor Management, by manually navigating to the /admin/ directory after authentication. The issue stems from improper access controls, mapped to CWE-284 (Improper Access Control), and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited by any authenticated low-privileged user, such as a self-registered patient, requiring no advanced skills beyond basic web navigation. Successful exploitation grants full administrative control over the application, enabling attackers to take over the system, view confidential user logs, and modify critical data like doctor information or other hospital records.
Advisories detailing the vulnerability are available at https://gist.github.com/Sanka1pp/c6f20cd6db1fbb1f0e7e199ead66691d and https://packetstorm.news/files/id/213711, published on 2026-02-18. These references provide proof-of-concept details but do not specify patches or mitigations in the available description.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of public-facing web application (T1190) resulting in privilege escalation (T1068) through improper access controls allowing low-privileged users to access admin dashboard.