CVE-2023-34651: Common-Vulnerabilities-and-Exposures/CVE-2023-34651 at main · ckalnarayan/Common-Vulnerabilities-and-Exposures

Permalink

Cannot retrieve contributors at this time

# Hospital Management System in php v.1.0 - Stored Cross-Site Scripting (XSS)Vulnerability

## Stored Cross Site Scripting Vulnerability found in Hospital Management System in php v.1.0

Vulnerability Description -

The Hospital Management System in php v.1.0, developed by PHPGurukul, is susceptible to a critical security vulnerability known as Stored Cross-Site Scripting (XSS). This vulnerability enables attackers to inject malicious JavaScript code, which is then stored and executed by the application.

Steps to Reproduce -

The following steps demonstrate how to exploit the Stored XSS vulnerability in the Hostel Management System v.1.0:

1. Visit the Hospital Management System in php v.1.0 application by accessing the URL: http://localhost/hospital/

2. Click on the “Patient Login” and Creat New Patient Account

“Full Name” “Address” “City” field, inject the following XSS payload, enclosed in brackets: {"><script>alert(“XSS”)</script>}.

3. Click on the “Submit” button.

3. Login to the Patient account using the Email id and Password Which You Have Entered, injected payload will be executed.

4. Go to the Edit Account Details Page,

“Full Name” “Address” “City” field, inject the following XSS payload, enclosed in brackets: {"><script>alert(“XSS”)</script>}.

6. Click on the “Submit” button.

7. Refresh the page, and the injected payload will be executed.

As a result of successful exploitation, the injected JavaScript code will be stored in the application’s database. Subsequently, whenever another user accesses the affected page, the injected code will execute, triggering an alert displaying the text “XSS.” This allows the attacker to execute arbitrary code within the user’s browser, potentially leading to further attacks or unauthorized actions.

**Reference: CVE-2023-34651**