Cross-Site Request Forgery Vulnerability in PHPGurukul Hospital Management System
CVE-2025-70062

6.5MEDIUM

Key Information:

Vendor

PHPGurukul
Status
Hospital Management System
Vendor
CVE Published:
18 February 2026

What is CVE-2025-70062?

The PHPGurukul Hospital Management System v4.0 is susceptible to a Cross-Site Request Forgery (CSRF) flaw within its 'Add Doctor' functionality. The lack of CSRF token validation at the add-doctor.php endpoint allows remote attackers to exploit this vulnerability. By crafting a malicious webpage, attackers can trick authenticated administrators into executing unwanted actions, such as creating unauthorized doctor accounts with privileged access.

References

https://gist.github.com/Sanka1pp/78795abd84220e879ee04251...
https://packetstorm.news/files/id/213711

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.