Description

Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-28T16:18:31.793Z",
  "pubdate": "2026-08-28T16:18:31.793Z",
  "executiveSummary": "The Le-yan Medical Practice Management System contains a security vulnerability involving the improper transmission of sensitive data within URL parameters. This flaw facilitates the unauthorized exposure of protected health information (PHI) or authentication credentials through client-side artifacts. By leaking sensitive tokens, session identifiers, or PII via the Universal Resource Locator, the application enables attackers to gain access to private data stored in non-volatile locations such as browser history, proxy logs, or web server access logs. The vulnerability allows unauthenticated remote attackers to compromise user accounts or sensitive practice data without requiring complex exploitation techniques. This information disclosure constitutes a significant risk to data privacy and regulatory compliance, as the data remains accessible to any entity with visibility into the victim's request logs or browser cache history.",
  "technicalDetails": "The root cause of this vulnerability is the implementation of application-level logic that transmits sensitive data as query parameters within the URL string rather than utilizing secure request bodies via the HTTP POST method or secure cookie storage. When an application passes sensitive information—such as session tokens, medical record identifiers, or personal data—through GET requests, that information is inherently treated as part of the document path.\nThe exploitation flow begins when an unauthenticated attacker gains access to logs or artifacts generated during the lifecycle of the HTTP request. Because URLs are processed by multiple intermediaries, the sensitive information is stored in plaintext across several layers of the network infrastructure. Specifically, browser history records store the full URL, including sensitive query strings, on the client's local disk. Similarly, web server logs, proxy logs, and Intrusion Detection System (IDS) logs capture the full request URI, effectively logging the sensitive data alongside standard traffic metadata.\nThe attack flow proceeds as follows: First, the attacker triggers an action within the Le-yan Medical Practice Management System that causes a sensitive URL to be generated, potentially by enticing a user to click a crafted link or by observing traffic on a compromised network segment. Second, the sensitive data is encoded directly into the URI parameters. Third, this data is cached or logged by browser history files or server-side logging mechanisms. Fourth, the attacker retrieves this data through unauthorized access to the victim's machine, administrative access to log management systems, or via man-in-the-middle (MITM) techniques if the transport is not adequately secured. The post-exploitation impact is severe, as the leaked data may allow the attacker to conduct session hijacking, unauthorized data exfiltration, or identity theft, effectively bypassing authentication mechanisms that rely on the integrity of the data passed in the URL. This vulnerability is exacerbated by the lack of input sanitization and a failure to enforce modern web security standards that prioritize the concealment of sensitive state information."
}