PT-2021-21247 · Unknown · Care2X Hospital Information Management

Published 2021-08-26 · Updated 2021-09-01 · CVE-2021-36352

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Care2x Hospital Information Management version 2.7 Alpha

Description A stored cross-site scripting (XSS) issue has been identified. The vulnerability is found in POST requests to the "/modules/registration admission/patient register.php" page, specifically with the parameters name middle, addr str, station, name maiden, name 2, and name 3.

Recommendations For Care2x Hospital Information Management version 2.7 Alpha, consider disabling the parameters name middle, addr str, station, name maiden, name 2, and name 3 in the "/modules/registration admission/patient register.php" page as a temporary workaround until a patch is available. Restrict access to the patient registration module to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-36352

Affected Products

Care2X Hospital Information Management

References · 7

• 🔥 https://exploit-db.com/exploits/50197 · Exploit
• https://osv.dev/vulnerability/CVE-2021-36352 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36352 · Security Note
• https://t.me/cibsecurity/27902 · Telegram Post
• https://securityforeveryone.com/blog/care2x-hospital-information-management-system-0-day-vulnerability-cve-2021-36352 · Note
• https://t.me/cvenotify/20190 · Telegram Post
• https://t.me/cvenotify/20170 · Telegram Post