A critical privilege escalation vulnerability in PHPGurukul Hospital Management System v4.0 allows low-privileged users to achieve full administrative control over the application.

The application fails to perform adequate server-side authorization checks, allowing a low-privileged user (specifically a Patient role) to navigate to the /admin/ directory and gain full administrative access after authenticating with standard user credentials.

This vulnerability poses a severe risk to the confidentiality, integrity, and availability of sensitive medical and patient data. With a CVSS score of 8.8, the flaw enables unauthorized actors to view confidential system logs, manage doctor profiles, and perform administrative actions, which could lead to significant data breaches and regulatory non-compliance.

Immediate Action: Since a vendor-provided patch is currently unknown, administrators should restrict network access to the /admin/ directory to trusted IP addresses only or disable the administrative interface until a formal update is released.

Proactive Monitoring: Security teams should monitor web server access logs for requests to the /admin/ directory originating from accounts mapped to the Patient role.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or challenge access to the /admin/ path for any user session that does not possess explicit administrator privileges.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up on PacketStorm and the referenced GitHub Gist.

Given the ease with which a standard user can escalate privileges to administrator, this vulnerability requires immediate attention. Organizations utilizing PHPGurukul Hospital Management System v4.0 must implement strict access controls to the administrative panel immediately to mitigate the risk of unauthorized system takeover.