Le Yan
Monthly
Remote code execution in Le-yan's Medical Practice Management System allows unauthenticated remote attackers to execute arbitrary OS commands on the server by inducing a user to visit a crafted HTML page. The root cause is CWE-940 (Improper Verification of Source of a Communication Channel), indicating the application processes incoming requests without validating their origin - a pattern consistent with CSRF-driven command injection where the server's trust of unverified channels is the enabling weakness. No public exploit code has been identified and no CISA KEV listing is present, but the CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system reflects high severity with significant consequences in a healthcare data context.
Sensitive data exposure in Le-yan's Medical Practice Management System enables access to confidential medical or patient data through URL query string parameters that persist in browser history and server or proxy log files (CWE-598). The application transmits sensitive values via HTTP GET parameters rather than POST body or secure headers, causing this data to be recorded in multiple secondary storage locations outside the intended session scope. No public exploit code has been identified at the time of analysis, but the attack class requires minimal technical sophistication once access to affected log or history files is established; medical data sensitivity elevates real-world impact beyond what the base CVSS score alone suggests.
Le-show medical practice management system from Le-yan has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Remote code execution in Le-yan's Medical Practice Management System allows unauthenticated remote attackers to execute arbitrary OS commands on the server by inducing a user to visit a crafted HTML page. The root cause is CWE-940 (Improper Verification of Source of a Communication Channel), indicating the application processes incoming requests without validating their origin - a pattern consistent with CSRF-driven command injection where the server's trust of unverified channels is the enabling weakness. No public exploit code has been identified and no CISA KEV listing is present, but the CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system reflects high severity with significant consequences in a healthcare data context.
Sensitive data exposure in Le-yan's Medical Practice Management System enables access to confidential medical or patient data through URL query string parameters that persist in browser history and server or proxy log files (CWE-598). The application transmits sensitive values via HTTP GET parameters rather than POST body or secure headers, causing this data to be recorded in multiple secondary storage locations outside the intended session scope. No public exploit code has been identified at the time of analysis, but the attack class requires minimal technical sophistication once access to affected log or history files is established; medical data sensitivity elevates real-world impact beyond what the base CVSS score alone suggests.
Le-show medical practice management system from Le-yan has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.