CVE-2023-31498
Published: 11 May 2023
Summary
CVE-2023-31498 is a critical-severity Session Fixation (CWE-384) vulnerability in Phpgurukul Hospital Management System. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A privilege escalation vulnerability tracked as CVE-2023-31498 affects PHP Gurukul Hospital Management System version 4.0 and stems from improper handling of the session token parameter, corresponding to CWE-384. The flaw received a CVSS 3.1 score of 9.8, reflecting network-accessible attack conditions that require no authentication or user interaction and can result in full compromise of confidentiality, integrity, and availability.
An unauthenticated remote attacker can supply a crafted session token to escalate privileges, execute arbitrary code on the server, and retrieve sensitive information stored by the application. The published description indicates the issue can be triggered directly over the network without any prior foothold.
Public references consist of researcher disclosures on GitHub and Gist that appear to contain proof-of-concept material; no vendor advisory, patch information, or official mitigation guidance is provided in the available sources.
EPSS scores reached a peak of 0.0965 before settling at the current value of 0.0583, indicating modest post-disclosure interest without evidence of widespread exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-35803
Vulnerability details
A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to execute arbitrary code and access sensitive information via the session token parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Session termination after a set interval shortens the usable lifetime of a fixed session identifier, making successful exploitation of session fixation more difficult.
Re-authentication typically forces issuance of a new session, limiting the window for exploitation of a previously fixed session identifier.
Enforces proper session ID generation and binding, preventing fixation of a known session token.