Vertikal Systems Hospital Manager Backend Services ASP.NET Error Information Disclosure Vulnerability

A vulnerability exists in Vertikal Systems Hospital Manager Backend Services, prior to September 19, 2025, where the application returned detailed ASP.NET error pages for invalid WebResource.axd requests. This error messaging disclosed sensitive information, including framework and ASP.NET version details, stack traces, internal file paths, and the insecure 'customErrors mode="Off"' configuration. Such information could have aided reconnaissance efforts by unauthenticated attackers.

Impact

Exploitation of this vulnerability could allow an unauthenticated attacker to gather sensitive information about the server and the application, potentially facilitating further attacks.

Remediation

Vertikal Systems has addressed this vulnerability. For more information, users should contact Vertikal Systems support.