Executive brief
The Medical Management System, a web application used for managing healthcare data and staff, contains a security flaw that allows anyone on the network to reset any user's password without authentication. An attacker could use this to take over administrative or staff accounts, potentially gaining access to sensitive medical records or disrupting hospital operations. The vulnerability resets the target account's password to a known default value.
Technical details
The Medical Management System (commit a81df1ce700a9662cb136b27af47f4cbde64156b) contains an insecure permission vulnerability in its password reset functionality. The root cause is the use of the '@IgnoreAuth' annotation on the 'resetPass' methods within 'UsersController.java' and 'YuangongController.java', which instructs the 'AuthorizationInterceptor' to skip authentication checks. A remote, unauthenticated attacker can exploit this by sending a GET request to the '/resetPass' endpoint with a target 'username' parameter. Successful exploitation resets the target user's password to the hardcoded value '123456'.
Affected products
- zhuo_zou Medical Management System a81df1ce700a9662cb136b27af47f4cbde64156b
Timeline
- 2025-12-07: disclosed: Initial vulnerability report on Gitee
- 2026-05-15: advisory: CVE-2025-67437 published