ADMX hospital system leaks patient records via IDOR
CVE-2025-4596 in Asseco ADMX hospital information system allows authenticated patients to access other patients' medical files through parameter manipulation.
CERT Polska has disclosed CVE-2025-4596, an insecure direct object reference (IDOR) vulnerability in Asseco ADMX, a hospital information system used for processing medical records. The flaw allows authenticated patients to access medical files belonging to other patients by manipulating GET request parameters containing document IDs. This represents a significant privacy breach in a healthcare context, as patient medical records are subject to strict regulatory protections.
The vulnerability was reported through responsible disclosure by Wiktor Mróz and has been patched in ADMX version 6.09.01.62. Organizations running ADMX should prioritize upgrading to the fixed version to prevent unauthorized access to sensitive patient health information. The issue affects the confidentiality of medical data but requires authenticated access to exploit.
Mentioned in this report
Detection guidance
Potential IDOR Exploitation via Sequential Document ID Manipulation in Web Requests
Detects an authenticated web session issuing GET requests with rapidly incrementing or non-owned document/record ID parameters, consistent with IDOR-style enumeration of medical records in systems like ADMX (CVE-2025-4596). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Sequential Document ID Parameter Enumeration in Web Application Requests
id: 57556fdd-4ec3-52c3-b4d4-055770885d19
status: experimental
description: 'Detects HTTP GET requests to a web application that reference document,
record, or file identifiers via query parameters, where the same authenticated user
rapidly requests many distinct ID values in a short window. This pattern is consistent
with Insecure Direct Object Reference (IDOR) exploitation such as CVE-2025-4596
in Asseco ADMX, where authenticated patients manipulated document ID parameters
to access other patients'' medical records. Because this rule cannot express a count/threshold
in the condition, SOC analysts should treat repeated matches from the same user/session
within a short period (e.g. more than 15 distinct IDs per minute) as the actionable
signal.
'
references:
- https://cve.mitre.org/cgirequest.cgi?name=CVE-2025-4596
logsource:
category: webserver
product: webserver
detection:
selection:
cs-uri-query|re: (?i)(doc(ument)?id|record(id)?|fileid|patientid)=[0-9]+
cs-method: GET
sc-status: 200
filter_static_assets:
cs-uri-stem|contains:
- /static/
- /assets/
- /css/
- /js/
condition: selection and not filter_static_assets
falsepositives:
- Legitimate clinical staff or patients browsing multiple of their own documents in
a single session
- Automated QA/monitoring scripts that enumerate document IDs for health checks
- Bulk export or migration tooling accessing records sequentially
level: medium
tags:
- attack.t1213
- cve.2025.4596
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-4596
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free