PT-2022-15709 · Sourcecodtester Hospital · Patient Record Management System

Sant268 · Published 2022-01-26 · Updated 2022-02-02 · CVE-2022-22851

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sourcecodtester Hospital's Patient Records Management System version 1.0

Description A Stored Cross Site Scripting (XSS) issue exists via the specialization parameter in the "doctors.php" endpoint. This allows for potential malicious script execution.

Recommendations For version 1.0, consider disabling the specialization parameter in the "doctors.php" endpoint until a patch is available to prevent exploitation. Restrict access to the "doctors.php" endpoint to minimize the risk of XSS attacks. Avoid using the specialization parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-22851

Affected Products

Patient Record Management System

References · 6

• 🔥 https://github.com/Sant268/CVE-2022-22851/commit/17381378bdb7c9f7b3326af6fb79cf68ca9f9d3d · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-22851 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22851 · Vendor Advisory
• https://sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html · Note
• https://t.me/cibsecurity/36312 · Telegram Post
• https://t.me/cvenotify/26141 · Telegram Post