PT-2021-16797 · Unknown · Online Doctor Appointment System

Janobe + 2 · Published 2021-07-23 · Updated 2021-08-03 · CVE-2021-25791

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Online Doctor Appointment System version 1.0

Description The issue concerns stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module. Authenticated attackers can execute arbitrary web scripts or HTML via crafted payloads in the First Name, Last Name, and Address text fields.

Recommendations For Online Doctor Appointment System version 1.0, consider validating and sanitizing user input in the First Name, Last Name, and Address fields to prevent the execution of malicious scripts. As a temporary workaround, restrict access to the "Update Profile" module until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-25791

Affected Products

Online Doctor Appointment System

References · 6

• 🔥 https://exploit-db.com/exploits/49396 · Exploit
• https://osv.dev/vulnerability/CVE-2021-25791 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25791 · Security Note
• https://t.me/cvenotify/18051 · Telegram Post
• https://sourcecodester.com · Note
• https://sourcecodester.com/php/14663/online-doctor-appointment-system-php-full-source-code.html · Note