CGM CliniNET Session ID Exposure Vulnerability

A vulnerability exists in CGM CliniNET software, all versions prior to 2025.M1, where certain CGI scripts expose session ID data. The affected scripts are 'userlogstat.pl', 'usrlogstat.pl', and 'dblogstat.pl', all located in the 'CliniNET.prd/utils/' directory. This exposure of session IDs could lead to session hijacking.

Impact

Exploitation of this vulnerability allows for session hijacking, potentially leading to unauthorized access to user accounts, including those with administrative privileges.