CVE-2024-51360 is a critical severity (CVSS 9.8) flaw in PHPGurukul Hospital Management System in PHP v4.0, where the doctor edit-profile page allows a remote attacker to run arbitrary code. The record lists no fix. Take any copy off the internet and review the code before using it again.
What's affected
The record names PHPGurukul Hospital Management System in PHP, version 4.0, and points at the file hms/doctor/edit-profile.php.
The NVD record does not list a fixed version, and the researcher document it links to could not be retrieved during review. The file name of that document refers to session hijacking, but the record itself only states that arbitrary code can be run. Do not rely on this post for more detail than the record gives.
Any system that holds patient or staff data raises the cost of a mistake, so the hospital management context makes careful handling important, especially if the code was installed from a downloaded package.
How to check if you're exposed
Check your servers for the application directory and find the file.
find /var/www -path "*hms/doctor/edit-profile.php" 2>/dev/null
If it is present, review who can reach the page and how the profile form handles uploaded files and input. Check web server logs for POST requests to that file from unfamiliar addresses, and look for files in the web directory that you did not put there.
What to do now
- Find every copy of the application in your estate.
- Remove it from internet access, or restrict it to a trusted network or a VPN.
- Review the edit-profile code for unsafe file handling and unchecked input, and fix it or retire the application.
- Check the web directory for unexpected files and the logs for unusual requests.
- Reset administrator and database credentials used by the application.
- If patient data was held, involve your privacy and security owners.
Why it matters
The record classes the weakness as CWE-94 (Code Injection), where data supplied by a user ends up executed as code by the server. In a PHP application that is often through an upload that is saved with an executable extension, or through input passed to an evaluation function. The record does not say which, so this post does not guess.
What the score shows is network reach with no privileges and full impact. Small management applications are often installed once and never updated. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-51360.
Quick check
Is there a vendor fix for CVE-2024-51360?
The record lists none, so assume the code is unpatched until you have evidence otherwise.
Does the record give attack details?
No. It states only that arbitrary code can run through the edit-profile page, and this post does not add detail.
Sources
- Researcher document (listed in the NVD record, not retrievable during review)
- Gold entry for CVE-2024-51360
Last reviewed: 19 October 2026.
