CVE-2023-40278

HIGH

OpenClinic GA 5.247.01 - Information Disclosure via AppointmentUid Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-40278. PoCs published by VB.

AI-analyzed exploit summary This is a writeup describing an information disclosure vulnerability in OpenClinic GA 5.247.01. The vulnerability allows an attacker to deduce the existence of specific appointments by manipulating the `AppointmentUid` parameter in the `printAppointmentPdf.jsp` component.

Description

An issue was discovered in OpenClinic GA 5.247.01. An Information Disclosure vulnerability has been identified in the printAppointmentPdf.jsp component of OpenClinic GA. By changing the AppointmentUid parameter, an attacker can determine whether a specific appointment exists based on the error message.

Exploits (1)

exploitdb WRITEUP
by VB · webappsphp
https://www.exploit-db.com/exploits/51994

This is a writeup describing an information disclosure vulnerability in OpenClinic GA 5.247.01. The vulnerability allows an attacker to deduce the existence of specific appointments by manipulating the `AppointmentUid` parameter in the `printAppointmentPdf.jsp` component.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: OpenClinic GA 5.247.01
No auth needed
Prerequisites: Access to the target URL
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 7.5
EPSS 0.0300
EPSS Percentile 85.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (1)
openclinic_ga_project/openclinic_ga 5.247.01
Published Mar 19, 2024
Tracked Since Feb 18, 2026