Technical impact
The vulnerability arises from the use of reversible Base64 encoding to protect sensitive data in e-Sushrut HMIS. An attacker with valid credentials can decode, modify, and re‑encode Base64 parameters in request URLs, allowing tampering and unauthorized disclosure of protected information. This flaw permits an authenticated user to bypass normal authorization controls and access or view data that should remain confidential.
Affected Systems
The issue affects the CDAC‑Noida e‑Sushrut Hospital Management Information System (HMIS). All earlier releases listed as previous_versions in the CPE are susceptible; the latest vetted release is not known to be affected.
Risk and Exploitability
The CVSS score of 7.1 indicates a high severity, while the EPSS is not listed, suggesting current exploitation likelihood is unknown; the vulnerability is not catalogued in CISA’s KEV. The likely attack vector is remote over HTTP, requiring the attacker to first authenticate to the system and then craft manipulated request URLs to extract or modify sensitive data. Once exploited, the attacker can read or alter confidential information, compromising data confidentiality and integrity.
