Submit #906740: code-projects Hospital Information System 1.0 Cross Site Scripting

The Hospital Information System in PHP is potentially vulnerable to Reflected Cross-Site Scripting in the patient-management functionality implemented by editPatient.php.

The endpoint accepts a patient identifier through the id GET parameter. This identifier is expected to reference an existing patient record but appears to accept arbitrary user-controlled characters.

The supplied test request contains the following value:

16bi66i"><script>alert(1)</script>iz60f
The quotation mark and closing angle bracket are intended to terminate an existing HTML attribute or markup context, while the following element introduces executable JavaScript:

<script>alert(1)</script>
If the application outputs the raw id parameter into an HTML page without encoding special characters such as <, >, ", and ', attacker-controlled input can alter the structure of the returned document.

When a victim accesses a specially crafted request, the application may reflect the malicious parameter into the generated page. The victim's browser then interprets the injected <script> element as JavaScript and executes it within the origin of the Hospital Information System.

Successful exploitation can therefore allow attacker-controlled JavaScript to execute in the context of an authenticated user's session.

Depending on the victim's privileges and the application's protections, successful exploitation may enable unauthorized actions using the victim's session, manipulation of displayed patient information, access to information available to client-side scripts, phishing content injection, or other browser-based attacks.

Because the request contains a PHP session cookie and originates from the patient-management interface, exploitation may require an authenticated user to access the affected endpoint. The precise authentication requirements should be verified during testing.

The vulnerability results from failure to apply proper contextual output encoding to attacker-controlled request parameters before including those values in dynamically generated HTML.

• Source: ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20Hospital%20Information%20System%20%60id%60%20Parameter.md
• User: AhmadMarzouk (UID 95993)
• Submission: 07/27/2026 20:13 (1 month ago)
• Moderation: 09/06/2026 18:36 (1 month later)
• Status: Accepted
• VulDB entry: 399465 [code-projects Hospital Information System 1.0 Patient Management editPatient.php ID cross site scripting]
• Points: 20