Medical Practice Management System
Monthly
Remote code execution in Le-yan's Medical Practice Management System allows unauthenticated remote attackers to execute arbitrary OS commands on the server by inducing a user to visit a crafted HTML page. The root cause is CWE-940 (Improper Verification of Source of a Communication Channel), indicating the application processes incoming requests without validating their origin - a pattern consistent with CSRF-driven command injection where the server's trust of unverified channels is the enabling weakness. No public exploit code has been identified and no CISA KEV listing is present, but the CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system reflects high severity with significant consequences in a healthcare data context.
Remote code execution in Le-yan's Medical Practice Management System allows unauthenticated remote attackers to execute arbitrary OS commands on the server by inducing a user to visit a crafted HTML page. The root cause is CWE-940 (Improper Verification of Source of a Communication Channel), indicating the application processes incoming requests without validating their origin - a pattern consistent with CSRF-driven command injection where the server's trust of unverified channels is the enabling weakness. No public exploit code has been identified and no CISA KEV listing is present, but the CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system reflects high severity with significant consequences in a healthcare data context.