E Sushrut Hospital Management Information System Hmis
Monthly
Unauthorized patient-data disclosure in C-DAC's e-Sushrut Hospital Management Information System (HMIS) allows an authenticated user to read other patients' sensitive records by tampering with an identifier parameter in an API request URL. The flaw is a classic insecure-direct-object-reference (IDOR) authorization gap reported by CERT-In (CIVN-2026-0207); there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at only 0.05%, but the low attack complexity makes abuse trivial for any logged-in account.
Account takeover in C-DAC's e-Sushrut Hospital Management Information System (HMIS) arises because one-time passwords (OTPs) are returned in plaintext inside API responses, letting a remote attacker who can observe those responses harvest a valid OTP and impersonate the targeted user. CERT-In flagged the flaw (CIVN-2026-0207) and it is tagged as an authentication bypass; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.17%. The CVSS 4.0 vector rates it 8.8 with high confidentiality impact and no privileges or user interaction required.
Authentication bypass in CDAC-Noida's e-Sushrut Hospital Management Information System (HMIS) lets remote attackers gain unauthorized access to user accounts by tampering with server responses. The login flow trusts client-side response parameters to decide whether authentication succeeded, so an attacker who intercepts and rewrites the response is treated as authenticated. Reported by CERT-In (CIVN-2026-0207); no public exploit identified at time of analysis, and EPSS is low at 0.31% (54th percentile).
Unauthorized patient-data disclosure in C-DAC's e-Sushrut Hospital Management Information System (HMIS) allows an authenticated user to read other patients' sensitive records by tampering with an identifier parameter in an API request URL. The flaw is a classic insecure-direct-object-reference (IDOR) authorization gap reported by CERT-In (CIVN-2026-0207); there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at only 0.05%, but the low attack complexity makes abuse trivial for any logged-in account.
Account takeover in C-DAC's e-Sushrut Hospital Management Information System (HMIS) arises because one-time passwords (OTPs) are returned in plaintext inside API responses, letting a remote attacker who can observe those responses harvest a valid OTP and impersonate the targeted user. CERT-In flagged the flaw (CIVN-2026-0207) and it is tagged as an authentication bypass; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.17%. The CVSS 4.0 vector rates it 8.8 with high confidentiality impact and no privileges or user interaction required.
Authentication bypass in CDAC-Noida's e-Sushrut Hospital Management Information System (HMIS) lets remote attackers gain unauthorized access to user accounts by tampering with server responses. The login flow trusts client-side response parameters to decide whether authentication succeeded, so an attacker who intercepts and rewrites the response is treated as authenticated. Reported by CERT-In (CIVN-2026-0207); no public exploit identified at time of analysis, and EPSS is low at 0.31% (54th percentile).