C-DAC e-Sushrut OTP Exposure Vulnerability Allowing Unauthorized Access

A vulnerability in the C-DAC e-Sushrut Hospital Management Information System (HMIS) allows for the interception of one-time passwords (OTPs) in plaintext within API responses. This exposure could be exploited by a remote attacker to impersonate users and gain unauthorized access to their accounts. The vulnerability arises from inadequate protection of sensitive data in API communications.

Impact

Successful exploitation enables account takeover by allowing attackers to impersonate users and access their accounts on the system.

Remediation

Users are advised to contact C-DAC for instructions on upgrading to the latest version of the e-Sushrut HMIS.