PT-2021-4036 · Unknown · Chikitsa Patient Management System

Published 2021-06-08 · Updated 2021-08-12 · CVE-2021-38151

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chikitsa Patient Management System version 2.0.0

Description The issue is related to the index.php/appointment/todos endpoint in the Chikitsa Patient Management System, which allows for XSS attacks. This is due to the lack of protection measures for the web page structure. Exploitation of this issue can allow a remote attacker to impact the confidentiality and integrity of protected information.

Recommendations For Chikitsa Patient Management System version 2.0.0, consider disabling access to the index.php/appointment/todos endpoint until a patch is available to prevent potential XSS attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-04563

CVE-2021-38151

Affected Products

Chikitsa Patient Management System

References · 8

• 🔥 https://github.com/jboogie15/CVE-2021-38149 · Exploit
• 🔥❌ https://github.com/jboogie15/CVE-2021-38151 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2021-38151 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38151 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04563 · Security Note
• https://t.me/cvenotify/18754 · Telegram Post
• https://t.me/cibsecurity/26925 · Telegram Post
• https://chikitsa.net · Note