PT-2021-18582 · Unknown · Remote Clinic

Saud-Ahmad · Published 2021-04-12 · Updated 2021-08-27 · CVE-2021-30044

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Remote Clinic version 2.0

Description The issue is related to Cross Site Scripting (XSS) that can be exploited via the First Name or Last Name field on the "staff/register.php" API endpoint. This allows for potential malicious script injection.

Recommendations For Remote Clinic version 2.0, consider disabling the staff/register.php endpoint until a patch is available, or restrict input for the First Name and Last Name fields to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-30044

Affected Products

Remote Clinic

References · 6

• 🔥 https://github.com/remoteclinic/RemoteClinic/issues/13 · Exploit
• 🔥 http://packetstormsecurity.com/files/162262/RemoteClinic-2-Cross-Site-Scripting.html · Exploit
• 🔥 https://exploit-db.com/exploits/49781 · Exploit
• https://osv.dev/vulnerability/CVE-2021-30044 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30044 · Security Note
• https://t.me/cvenotify/13125 · Telegram Post